Requirements

Ensure that you meet these requirements before you attempt this configuration:

  • Make sure the internal network has two networks located on the inside of the ASA:
    • 192.168.0.0/24—Network directly connected to the ASA.
    • 192.168.1.0/24—Network on the inside of the ASA, but behind another device (for example, a router).
  • Make sure the internal users get PAT as follows:
    • Hosts on the 192.168.1.0/24 subnet will get PAT to a spare IP address given by the ISP (10.1.5.5).
    • Any other host behind the inside of the ASA will get PAT to the outside interface IP address of the ASA (10.1.5.1).

Components Used

The information in this document is based on these software and hardware versions:

  • Cisco Adaptive Security Appliance (ASA) with version 8.3(1)
  • ASDM version 6.3(1)

asa-dynamic-pat-01.gif

ASA CLI Configuration

This document uses the configurations shown below.

ASA Dynamic PAT Configuration 
ASA#configure terminal
Enter configuration commands, one per line.  End with CNTL/Z.


!--- Creates an object called OBJ_GENERIC_ALL.
!--- Any host IP not already matching another configured
!--- object will get PAT to the outside interface IP
!--- on the ASA (or 10.1.5.1), for internet bound traffic.


ASA(config)#object network OBJ_GENERIC_ALL
ASA(config-obj)#subnet 0.0.0.0 0.0.0.0
ASA(config-obj)#exit
ASA(config)#nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface


!--- The above statements are the equivalent of the
!--- nat/global combination (as shown below) in v7.0(x),
!--- v7.1(x), v7.2(x), v8.0(x), v8.1(x) and v8.2(x) ASA code:


nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface



!--- Creates an object called OBJ_SPECIFIC_192-168-1-0.
!--- Any host IP facing the the ‘inside’ interface of the ASA
!--- with an address in the 192.168.1.0/24 subnet will get PAT
!--- to the 10.1.5.5 address, for internet bound traffic.


ASA(config)#object network OBJ_SPECIFIC_192-168-1-0
ASA(config-obj)#subnet 192.168.1.0 255.255.255.0
ASA(config-obj)#exit
ASA(config)#nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5


!--- The above statements are the equivalent of the nat/global
!--- combination (as shown below) in v7.0(x), v7.1(x), v7.2(x), v8.0(x),
!--- v8.1(x) and v8.2(x) ASA code:


nat (inside) 2 192.168.1.0 255.255.255.0
global (outside) 2 10.1.5.5

ASA 8.3(1) Running Config 
ASA Version 8.3(1)
!
hostname ASA
1
names
!

!--- Configure the outside interface.

!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 10.1.5.1 255.255.255.0

!--- Configure the inside interface.

!
interface GigabitEthernet0/1
 nameif inside
 security-level 100
 ip address 192.168.0.1 255.255.255.0 
!
!
boot system disk0:/asa831-k8.bin
!
!
object network OBJ_SPECIFIC_192-168-1-0 
 subnet 192.168.1.0 255.255.255.0
object network OBJ_GENERIC_ALL 
 subnet 0.0.0.0 0.0.0.0
!
nat (inside,outside) source dynamic OBJ_GENERIC_ALL interface
nat (inside,outside) source dynamic OBJ_SPECIFIC_192-168-1-0 10.1.5.5