Cisco ASA Dynamic NAT Configuration

Hello Nicholas

The command nat (inside,outside) dynamic interface is employed in order for all NAT translations to use the IP address assigned to the outside interface as the translated address. In the case of a device connected to the Internet, this address would typically be a public IP address. This is convenient because that outside address is reachable from the Internet, and thus no additional routing is necessary to ensure it will be able to communicate with destinations on the Internet. Also, it delivers NAT to all inside hosts using the same outside address.

Alternatively, you can use the command nat (inside,outside) dynamic PUBLIC_POOL where PUBLIC_POOL is an ACL that defines a range of IP addresses to use. In this case, the NAT router will dynamically choose which outside address to use from that particular pool of addresses. The difference here is that those outside addresses are not the same as the address assigned to the outside interface. For this reason, routing must be configured such that the ISP will be able to route traffic destined for those addresses to your outside interface.

Now what are the benefits of each choice? Well, there is no benefit for either solution as far as resource usage goes. The same number of NAT translations will consume memory within the NAT router whether they use the same or different IP addresses.

The only benefit of using the address pool is that you have a theoretically larger number of translations than you can achieve using the interface alone. NAT typically uses transport layer ports ranging from 49125 to 65535 (the dynamic or private port range) for translation, a range of over 16000 ports. Thus, each IP address can theoretically translate up to 16000 internal hosts. By employing more outside IP addresses, you can multiply this limit. In most implementations, memory and CPU resources of the NAT router will be exhausted well before the number of ports will be consumed. Only in situations where we have carrier-grade NAT where thousands of devices use NAT will this actually play a role.

Conversely, using the interface is beneficial due to the fact that you don’t need to worry about routing. So unless you have very specific parameters that you need to fulfill, using the interface will be more than enough to serve even the largest enterprise networks with NAT.

Take a look at this NetworkLessons note on specifying the outside IP address for NAT for more info.

I hope this has been helpful!

Laz