Cisco 7604 Configuration Guide - Page 322

Configuring NAT Control Chapter 16 Configuring NAT Figure 16-13 shows a web server and DNS server on the outside. The FWSM has a static translation for the outside server. In this case, when an inside user requests the address for ftp.example.com from the DNS server, the DNS server responds with the real address, 209.165.20.10. Because you want inside users to use the mapped address for ftp.example.com (10.1.2.56) you need to configure DNS reply modification for the static translation. Figure 16-13 DNS Reply Modification Using Outside NAT ftp.example.com 209.165.201.10 Static Translation on Inside to: 10.1.2.56 DNS Server 1 DNS Query 2 ftp.example.com? DNS Reply 209.165.201.10 3 DNS Reply Modification 209.165.201.10 10.1.2.56 4 DNS Reply 10.1.2.56 Outside Inside User 10.1.2.27 7 FTP Request 209.165.201.10 6 Dest Addr. Translation 10.1.2.56 209.165.201.10 5 FTP Request 10.1.2.56 132924 See the following command for this example: hostname(config)# static (outside,inside) 10.1.2.56 209.165.201.10 netmask 255.255.255.255 dns Configuring NAT Control NAT control requires that packets traversing from an inside interface to an outside interface match a NAT rule. See the "NAT Control" section on page 16-5 for more information. To enable NAT control, enter the following command: hostname(config)# nat-control To disable NAT control, enter the no form of the command. 16-18 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01