Comments on: Dynamic NAT

By: Harrison Parks

Harrison Parks — Mon, 06 Feb 2023 06:58:52 +0000

Hi Ed,

Thanks for the great articles. I continuously come back to these.

In the dynamic NAT diagrams, the port is listed in the translation table. Is traffic from the outside that hits the NAT device with a destination address matching a post-translation address that is currently in the translation table untranslated and forwarded, or does this only happen if the destination port also matches the post-translation port?

If so, is it true to say that strictly speaking dynamic NAT does not translate the port, but it does consider it?

By: Ed Harmoush

Ed Harmoush — Sat, 15 Oct 2022 00:09:50 +0000

In reply to Alan. You're welcome!

By: Alan

Alan — Tue, 27 Sep 2022 21:10:08 +0000

Great article, Ed! Thank you so much.

By: Arnold

Arnold — Sun, 01 Aug 2021 08:50:43 +0000

If a single IP address is shared among many internal users, and if the port number changes, than it is indeed a Dynamic PAT.

Typo: then

Excellent articles; thanks.

By: Binh Thanh Nguyen

Binh Thanh Nguyen — Thu, 03 Oct 2019 05:35:45 +0000

Thanks, nice post

By: Matt

Matt — Thu, 23 May 2019 21:10:49 +0000

Hi Ed,

I have a single public IP – 100.1.1.49 which is already NATted to 192.168.1.36 (Proxy) using a Manual NAT as follows:

ASA#config t
object-group network Proxy-Out-Int
network-object host 192.168.1.36
exit

object-group network Public-Int
network-object host 100.1.1.29
exit

nat (inside,outside) source static Proxy-Out-Int Public-Int

Now I have additional two proxies to deploy to leverage on the existing public IP (100.1.1.29)

Can I create additional two STATIC NAT to achieve this, and will still get the new proxies to work, as shown below ?

ASA#config t
object-group network Proxy-Out-Int2
network-object host 192.168.1.37
exit

ASA#config t
object-group network Proxy-Out-Int3
network-object host 192.168.1.38
Exit

nat (inside,outside) source static Proxy-Out-Int2 Public-Int
nat (inside,outside) source static Proxy-Out-Int3 Public-Int

OR should I just remove the existing MANUAL (STATIC) NAT and put in an entire new config for MANUAL (DYNAMIC) NAT ?, see below

ASA#config t
object-group network Proxy-Out-Int
range 192.168.1.36 192.168.1.38
exit

object-group network Public-Int
network-object host 100.1.1.29
exit

nat (inside,outside) source dynamic Proxy-Out-Int Public-Int

I would appreciate your help on this, thanks.

By: Ed Harmoush

Ed Harmoush — Mon, 29 Oct 2018 17:52:43 +0000

In reply to Nathan. Hi Nathan, Glad you enjoyed the article! The syntax you provided appears to be a Cisco ASA. If so, you might find your answer in this article. The syntax you provided is also a little off, so maybe after reading through that article please feel free to ask again and provide the full syntax of what you are trying to compare. Alternatively, you might want to try in the Network Engineering Stack Exchange or the Networking Sub Reddit.

By: Nathan

Nathan — Thu, 25 Oct 2018 20:51:29 +0000

Ed,
This is a very well written article. Mentioning and recommending the deterministic design patterns as you noted in latter part of your article is a good foundation block for building security. I have a specific question regarding . Is there ever a use case to dynamically NAT an interface to a single ip address. E.G. Nat(inside,outside) dynamic 100.100.100.100 . Is there a difference between that and this – Nat(inside,outside) static 100.100.100.100
I would appreciate your insight

By: Vishal kumar

Vishal kumar — Thu, 07 Dec 2017 18:32:15 +0000

In reply to Vishal kumar. Sorry i just read the yellow post and u have mentioned it there ..i guess i skiped that part by mistake

By: Vishal kumar

Vishal kumar — Thu, 07 Dec 2017 18:28:32 +0000

In this article, u r talking about active type of FTP which ofcourse would be possible in dynamic nat case but if it is a passive connection then dynamic pat should work i guess.