# Cisco ASA Static NAT Configuration
**URL:** https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817
**Category:** Lessons Discussion
**Created:** [December 19, 2016, 4:09pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817 "2016-12-19T16:09:26Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [December 19, 2016, 4:09pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/1 "2016-12-19T16:09:26Z")
This topic is to discuss the following lesson:
> **[Cisco ASA Static NAT Configuration](https://networklessons.com/cisco/asa-firewall/cisco-asa-static-nat-configuration)**
>
> This lesson explains how to configure and verify static (Network Address Translation) NAT on your Cisco ASA Firewall.
---
### Author:  [@sims](https://forum.networklessons.com/u/sims)
#### Post date: [January 11, 2016, 11:06pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/2 "2016-01-11T23:06:45Z")
Hi Rene ,
Could you explain twice nat and use cases also ?
Thank you
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [January 12, 2016, 3:52pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/3 "2016-01-12T15:52:04Z")
Hi Sims,
I will, added it to the list.
Rene
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [April 7, 2016, 9:35pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/4 "2016-04-07T21:35:44Z")
Hi Rene,
Need help again, So its NAT this time.
```auto
ASA1(config)# object network WEB_SERVER
ASA1(config-network-object)# host 192.168.1.1
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static 192.168.2.200
```
Let’s call this statement A.
The configuration above tells the ASA that whenever an outside device connects to IP address 192.168.2.200
that it should be translated to IP address 192.168.1.1.
```auto
ASA1(config)# object network DMZ
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL
```
Let’s call this statement B.
The configuration above tells the ASA to translate any IP address from the subnet DMZ (192.168.1.0 /24) to an
IP address in the PUBLIC\_POOL (10.10.10.0 /24).
Both NAT statement`s are similar except one has a IP other has a POOL.
statement-A is performing translation for the inbound traffic
statement-B is performing translation for outbound traffic
My question is what part of command makes ASA to perform translation on INBOUND traffic or OUTBOUND traffic and on which interface.
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 7, 2016, 10:05pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/5 "2016-04-07T22:05:53Z")
Hi Asi,
The first statement tells the ASA that a device with IP address 192.168.1.1 on the DMZ has to be translated to 192.168.2.200 which is on the outside. On the interfaces we configured to which security-zone it belongs (INSIDE, DMZ or OUTSIDE).
The direction doesn’t matter…from the outside you can connect to 192.168.2.200 and it will be translated to 192.168.1.1. When 192.168.1.1 initiates traffic that goes from DMZ \> outside then it also gets translated to 192.168.2.200. The only thing the ASA cares about is what to translate.
The same thing applies to the second statement except that the first time when traffic goes from DMZ to OUTSIDE, an IP address from the pool is selected. When the translation is in place, you can also connect from the outside to the pool address if you want…the ASA only cares about what to translate.
Rene
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [April 9, 2016, 2:45pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/6 "2016-04-09T14:45:01Z")
hi Rene Thanks for the reply
i got most of it ,Actually my confusion started by reading the following configuration from cisco. For last if you can explain short and simple on waht is REAL\_ifc and MAPPED\_ifc from the below example this will make it crystal clear
Thanks in Advance
nat **(real\_ifc,mapped\_ifc) dynamic mapped\_obj [interface] [dns]**
**Example:
hostname (config-network-object)# nat (inside,outside) dynamic MAPPED\_IPS interface
Configures dynamic NAT for the object IP addresses. See the following guidelines:**
**\*\*\*Interfaces —If you do not specify the real and mapped interfaces, all interfaces are used. You can also specify the keyword any for one or both of the interfac**
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 9, 2016, 5:02pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/7 "2016-04-09T17:02:33Z")
Hi Asi,
The mapped interface is the “exit” interface of the traffic. When traffic goes from a host on the INSIDE \> OUTSIDE then it is translated.
Rene
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [April 10, 2016, 1:14pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/8 "2016-04-10T13:14:25Z")
Hi Rene can you explain this one please
If I am writing an object NAT, from what basis can I make the decision to use the order of INTERFACE in my NAT command?
(INSIDE,OUTSIDE)
(OUTSIDE,INSIDE)
(INSIDE,DMZ)
(DMZ,OUTSIDE)
How can I decide which interface name to use first and second in NAT command? For example, NAT (which interface will be used here, which interface will this be here)?
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [April 17, 2016, 10:29pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/9 "2016-04-17T22:29:45Z")
Hi Asi,
As a rule of thumb, you can use (INSIDE,OUTSIDE) or (DMZ,OUTSIDE) when you want to translate the entire subnet of your INSIDE or DMZ to a public IP address.
(OUTSIDE,INSIDE) or (OUTSIDE,DMZ) can be used for port forwarding.
Rene
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [May 2, 2016, 12:28am UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/10 "2016-05-02T00:28:58Z")
Hi Rene
Can you please outline the difference between the below configuration as both the NAT rule is mapping a subnet from LAN to an outside pool/subnet
```auto
ASA1(config)# object network INTERNAL
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config-network-object)# nat (INSIDE,OUTSIDE) dynamic PUBLIC_POOL
```
```auto
ASA1(config)# object network DMZ
ASA1(config-network-object)# subnet 192.168.1.0 255.255.255.0
ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL
```
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [May 2, 2016, 1:52pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/11 "2016-05-02T13:52:19Z")
Hi Asi,
The configuration is exactly the same. The only difference is the source. In the first example you are matching traffic from the INSIDE zone, the second one is for the DMZ.
Rene
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [May 2, 2016, 3:16pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/12 "2016-05-02T15:16:03Z")
Thanks for the response
I was looking at NAT statement where there is Nat(inside,outside)dynamic and the other is Nat(inside,outside)static both the commands are achieving pool-to-pool mapping or lets say subnet to pool mapping
Dynamic is mapping from pool to pool and static is mapping from one-to-one but we are using static here to map whole subnet to pool of IP-address as this is more for dynamic NAT
---
### Author:  [@abdullimran](https://forum.networklessons.com/u/abdullimran)
#### Post date: [May 12, 2016, 6:07pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/13 "2016-05-12T18:07:46Z")
Hi Rene,
can you please comment on above and would like to as -In a scenario where the a static NAT is performed and the mapped pool does not have same number of IP as the real pool. What is the outcome of this scenario
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [May 16, 2016, 8:48pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/14 "2016-05-16T20:48:22Z")
Hi Asi,
When you run out of IP addresses for your static NAT, you should get pool exhaustion messages on your ASA and you won’t be able to translate anything anymore. Static NAT is 1:1 translation.
If you use dynamic NAT, then you can add the “interface” parameter at the end of your NAT rule. This will enable “PAT fallback” in case your pool is exhausted.
Rene
---
### Author:  [@palanimuthukar](https://forum.networklessons.com/u/palanimuthukar)
#### Post date: [May 20, 2016, 8:38pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/15 "2016-05-20T20:38:33Z")
Hi Rene
In the NAT table of the ASA why the subnets are /23. We are using /24.
ASA1# nat: untranslation - OUTSIDE:10.10.10.3/23 to DMZ:192.168.1.3/23 (xp:0xab2b3980, policy:0xad2632a0)
Thanks
Palani
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [May 21, 2016, 2:14pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/16 "2016-05-21T14:14:48Z")
Hmm that is a good question. I just labbed it up again to make sure it wasn’t a copy/paste mistake or anything. It still shows up as /23. No idea why the ASA shows it like this…perhaps a cosmetic bug.
---
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [August 8, 2016, 8:03am UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/17 "2016-08-08T08:03:53Z")
Dear Rene,
In my network I have added a ASA 5525-X FW and behind the FW there is a Softswitch & Asterisk Server . FW simply perform a Double NAT operation. In this setup I saw IP-PHONE to IP-PHONE call connecting properly means signalling is okk but no voice.Assuming RTP is blocking on FW . For your information FW simply doing Double NAT operation. Is there any configuration on FW end to pass RTP Packect ?? Can you please help me to sort out the issue dear 🙂
---
### Author:  [@ReneMolenaar](https://forum.networklessons.com/u/ReneMolenaar)
#### Post date: [August 29, 2016, 5:31pm UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/18 "2016-08-29T17:31:37Z")
Hi Mohammad,
RTP/SIP and NAT is a pain…they never thought about NAT when SIP was designed.
The problem is that the private IP address will be visible in the SDP (Session Description Protocol) of SIP, and the device on the other end won’t be unable to send RTP packets to your end.
On your ASA, you can try to play with the **inspect sip** command. This inspects the SIP header and makes required changes…sometimes it works, other times you have to disable SIP inspection and use some access-list to accept the return traffic.
Rene
---
### Author:  [@Zaman.rubd](https://forum.networklessons.com/u/Zaman.rubd)
#### Post date: [September 7, 2016, 9:19am UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/19 "2016-09-07T09:19:22Z")
Thanks Rene . I have sorted out the issue when capturing the packet.Many Thanks
---
### Author:  [@michmoor](https://forum.networklessons.com/u/michmoor)
#### Post date: [September 17, 2016, 12:18am UTC](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817/20 "2016-09-17T00:18:51Z")
Hi Rene,
For static NAT, does it matter if the direction of the nat is from low to high or high to low.
What I mean is say for example:
nat (inside,outside) static – 100 to 0
nat (outside,inside) static – 0 to 100
Because to me static nat is bi directional it shouldnt matter which direction traffic is initated. Do you agree or should snat be from High to low in the config?
[Next page](https://forum.networklessons.com/t/cisco-asa-static-nat-configuration/817.md?page=2)