Showing results for 
Search instead for 
Did you mean: 

How to configure static NAT / static PAT command in the PIX, ASA and FWSM


Core issue

This contains the PIX / ASA / Firewall Services Module (FWSM) configuration for static translation.


The static command configuration is similar for the PIX Firewall, ASA and FWSM.

The Static NAT command creates a fixed translation of the real address to the mapped address. This command can be used in order to assign a single public IP address to the single local IP address.

Static NAT Example:

hostname(config)#static (inside,outside) netmask

This command maps an inside IP address ( to an outside IP address (

The Static PAT command can also be used where a single port of the public IP address can be mapped with the single port of the local IP address.

Static PAT Example:

In order to redirect Telnet traffic from the outside interface ( to the inside host at, enter this command:

hostname(config)#static (inside, outside) tcp telnet telnet netmask

The static PAT command is the same as static NAT, except it allows for the specification of the Transmission Control Protocol (TCP) or the User Datagram Protocol (UDP) and the port for the real and mapped addresses.

The static PAT feature can identify the same mapped address across many different static statements, so long as the port is different for each statement.

Note: You cannot use the same real or mapped address in multiple static commands between the same two interfaces. Do not use a mapped address in the static command that is also defined in a global command for the same mapped interface.

Community Member

So what do you do in situations where you need to do a static nat of outside IP to same Inside IP and offer PAT for example.


hostname(config)#static (inside, outside) tcp 443 10004 netmask

hostname(config)#static (inside, outside) tcp www www netmask


In this situation I've a need to translate https externally to 10004 and keep port 80 the same inside/outside.  I'm running both services on the same box and the DNS externally mapps to the same outside IP Address.

Content for Community-Ad