Cisco 7604 Configuration Guide - Page 310

NAT Overview Chapter 16 Configuring NAT If you want the added security of NAT control but do not want to translate inside addresses in some cases, you can apply a NAT exemption or identity NAT rule on those addresses. (See the "Bypassing NAT" section on page 16-33 for more information.) To configure NAT control, see the "Configuring NAT Control" section on page 16-18. Note In multiple context mode, the packet classifier relies on the NAT configuration in some cases to assign packets to contexts. If you do not perform NAT because NAT control is disabled, then the classifier might require changes in your network configuration. See the "How the FWSM Classifies Packets" section on page 4-3 for more information about the relationship between the classifier and NAT. NAT Types This section describes the available NAT types. You can implement address translation as dynamic NAT, Port Address Translation (PAT is also known as NAT overloading), static NAT, or static PAT or as a mix of these types. You can also configure rules to bypass NAT, for example, if you enable NAT control but do not want to perform NAT. This section includes the following topics: • Dynamic NAT, page 16-6 • PAT, page 16-8 • Static NAT, page 16-8 • Static PAT, page 16-9 • Bypassing NAT when NAT Control is Enabled, page 16-10 Dynamic NAT Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the destination network. The mapped pool can include fewer addresses than the real group. When a host you want to translate accesses the destination network, the FWSM assigns it an IP address from the mapped pool. The translation is added only when the real host initiates the connection. The translation is in place only for the duration of the connection, and a given user does not keep the same IP address after the translation times out. (See the timeout xlate command in the Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Command Reference.) Users on the destination network, therefore, cannot reliably initiate a connection to a host that uses dynamic NAT (even if the connection is allowed by an access list), and the FWSM rejects any attempt to connect to a real host address directly. See the following "Static NAT" or "Static PAT" sections for reliable access to hosts. Figure 16-6 shows a remote host attempting to connect to the real address. The connection is denied because the FWSM only allows returning connections to the mapped address. 16-6 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01