static vs nat/global

[ahensel]

Excluding an access-list, is there any difference between:

nat (inside) 1 172.16.5.10 net 255.255.255.255

global 1 (outside) 192.168.5.10 net 255.255.255.255

and

static (inside,outside) 1 192.168.5.10 172.16.5.10 net 255.255.255.255

thanks.

[nkhawaja]

One Major Difference. NAT/Global are for one way traffic from higer to lower security interface

whereas static is for BI-Directional traffic.

[ahensel]

Agreed, however, does it not only become bi-directional when the static statement is joined together with an access-list?

[nkhawaja]

do you mean NAT with Access-list?

[ahensel]

thanks again for the reply. i guess my question is this; does the static nat statement provide the same function as the one-to-one nat/global statements provided in my example?

thanks.

[nkhawaja]

again, the only difference is that with static NAT , you can have bi-directional communication. but with one-to-one nat/global. only one way communication.

[ahensel]

ok, i did not relize you could have bi-directional communication with only a static statement. I was under the assumption that the static statement would need to be combined with an access-list. thanks for the clarification.

[nkhawaja · Accepted solution]

actually static has to be combined with access-list for bi-directional communication.. You are right in a sense that

static = nat/global without access-list

basically the rule is that traffic is allowed from higher to lower security infterface by default

BUT

from lower to higher security communication you need an access-list along with STATIC

Thanks

Nadeem

[ahensel]

got it. thanks.