Cisco Security Cloud Control: Secure Firewall ASA Management

PDF

Cisco Security Cloud Control: Secure Firewall ASA Management

Common use cases for NAT

Updated: July 17, 2026

Want to summarize with AI?

Find details about common use cases for NAT for ASA device management, including translated addresses, rule behavior, interface scope, and policy impact.

Twice NAT and Manual NAT

Here are some common tasks that can be achieved using "Network Object NAT", also known as "Auto NAT":

Enable a Server on the Inside Network to Reach the Internet Using a Public IP address
Enable Users on the Inside Network to Access the Internet Using the Outside Interface's Public IP Address
Make a Server on the Inside Network Available on a Specific Port of a Public IP Address
Translate a Range of Private IP Addresses to a Range of Public IP Addresses

Network Object NAT and Auto NAT

Here is a common task that can be achieved using "Twice NAT", also know as "Manual NAT":

Prevent a Range of IP Addresses from Being Translated When Traversing the Outside Interface

Enable a Server on the Inside Network to Reach the Internet Using a Public IP address

Use Case

Use this NAT strategy when you have a server with a private IP address that needs to be accessed from the internet and you have enough public IP addresses to NAT one public IP address to the private IP address. If you have a limited number of public IP addresses, see Make a server on the inside network available to users on a specific port of a public IP address (that solution may be more suitable).

Strategy

Your server has a static, private IP address, and users outside your network have to be able to reach your server. Create a network object NAT rule that translates the static private IP address to a static public IP address. After that, create an access policy that allows traffic from that public IP address to reach the private IP address. Finally, deploy these changes to your device.

Before you begin

Before you begin, create two network objects. Name one object servername_inside and the other object servername_outside. The servername_inside network object should contain the private IP address of your server. The servername_outside network object should contain the public IP address of your server.

See Create Network Objects for instructions.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Network Object NAT.
	7.	In section 1, Type, select Static. Click Continue.
	8.	In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, perform these actions: Expand the Original Address menu, click Choose, and select the servername_inside object. Expand the Translated Address menu, click Choose, and select the servername_outside object.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save.
	13.	For ASA, deploy a Network Policy rule or for FDM-managed device, deploy an access control policy rule to allow the traffic to flow from servername_inside to servername_outside.
	14.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

Here are the entries that are created and appear in an ASA's saved configuration file as a result of this procedure.

Note

This does not apply to FDM-managed devices.

Objects created by this procedure:

object network servername_outside
host 209.165.1.29
object network servername_inside
host 10.1.2.29

NAT rules created by this procedure:

object network servername_inside
 nat (inside,outside) static servername_outside

Enable Users on the Inside Network to Access the Internet Using the Outside Interface's Public IP Address

Use Case

Allow users and computers in your private network to connect to the internet by sharing the public address of your outside interface.

Strategy

Create a port address translation (PAT) rule that allows all the users on your private network to share the outside interface public IP address of your device.

After the private address is mapped to the public address and port number, the device records that mapping. When incoming traffic bound for that public IP address and port is received, the device sends it back to the private IP address that requested it.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click Network Object NAT.
	7.	In section 1, Type, select Dynamic. Click Continue.
	8.	In section 2, Interfaces, choose any for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, perform these actions : Expand the Original Address menu, click Choose and select the any-ipv4 or any-ipv6 object depending on your network configuration. Expand the Translated Address menu, and select interface from the available list. Interface indicates to use the public address of the outside interface.
	10.	For an FDM-managed device, in section 5, Name, enter a name for the NAT rule.
	11.	Click Save.
	12.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

Here are the entries that are created and appear in an ASA's saved configuration file as a result of this procedure.

Note

This does not apply to FDM-managed devices.

Objects created by this procedure:

object network any_network
subnet 0.0.0.0 0.0.0.0

NAT rules created by this procedure:

object network any_network
nat (any,outside) dynamic interface

Make a Server on the Inside Network Available on a Specific Port of a Public IP Address

Use Case

If you only have one public IP address, or a very limited number, you can create a network object NAT rule that translates inbound traffic, bound for a static IP address and port, to an internal address. We have provided procedures for specific cases, but you can use them as a model for other supported applications.

Prerequisites

Before you begin, create three separate network objects, one each for an FTP, HTTP, and SMTP server. For the sake of the following procedures, we call these objects ftp-server-object, http-server-object, and smtp-server-object.

See Create Network Objects for instructions.

NAT Incoming FTP Traffic to an FTP Server

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Network Object NAT.
	7.	In section 1, Type, select Static. Click Continue.
	8.	In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, perform these actions: Expand the Original Address menu, click Choose, and select the ftp-server-object. Expand the Translated Address menu, click Choose, and select the Interface. Check Use Port Translation. Select tcp, ftp, ftp.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save. The new rule is created in section 2 of the NAT table.
	13.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

Here is the entry that is created and appears in the ASA's saved configuration file as a result of this procedure.

Note

This does not apply to FDM-managed devices.

Object created by this procedure

object network ftp-object
host 10.1.2.27

NAT rule created by this procedure

object network ftp-object
nat (inside,outside) static interface service tcp ftp ftp

NAT Incoming HTTP Traffic to an HTTP Server

Before you begin

Before you begin, create a network object for the http server. For the sake of this procedure, we will call the object, http-object.

See Create Network Objects for instructions.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Network Object NAT.
	7.	In section 1, Type, select Static. Click Continue.
	8.	In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, perform these actions: Expand the Original Address menu, click Choose, and select the http-object. Expand the Translated Address menu, click Choose, and select the Interface. Check Use Port Translation. Select tcp, http, http.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save. The new rule is created in section 2 of the NAT table.
	13.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

Here are the entries that are created and appear in an ASA's saved configuration file as a result of this procedure.

Note

This does not apply to FDM-managed devices.

Object created by this procedure


object network http-object
host 10.1.2.28

NAT rule created by this procedure

object network http-object
nat (inside,outside) static interface service tcp www www

NAT Incoming SMTP Traffic to an SMTP Server

Before you begin

Before you begin, create a network object for the smtp server. For the sake of this procedure, we will call the object, smtp-object.

See Create Network Objects for instructions.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Network Object NAT.
	7.	In section 1, Type, select Static. Click Continue.
	8.	In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, perform these actions: Expand the Original Address menu, click Choose, and select the smtp-server-object. Expand the Translated Address menu, click Choose, and select the Interface. Check Use Port Translation. Select tcp, smtp, smtp.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save. The new rule is created in section 2 of the NAT table.
	13.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

Here are the entries that are created and appear in an ASA's saved configuration file as a result of this procedure.

Note

This does not apply to FDM-managed devices.

Object created by this procedure

object network smtp-object
host 10.1.2.29

NAT rule created by this procedure

object network smtp-object
nat (inside,outside) static interface service tcp smtp smtp

Translate a Range of Private IP Addresses to a Range of Public IP Addresses

Use Case

Use this approach if you have a group of specific device types, or user types, that need to have their IP addresses translated to a specific range so that the receiving devices (the devices on the other end of the transaction) allow the traffic in.

Translate a Pool of Inside Addresses to a Pool of Outside Addresses

Before you begin

Create a network object for the pool of private IP addresses you want to translate and create a network object for the pool of public addresses you want to translate those private IP addresses into.

For the ASA, the "original address" pool, (the pool of private IP addresses you want to translate) can be a network object with a range of addresses, a network object that defines a subnet, or a network group that includes all the addresses in the pool. For the FTD, the "original address" pool can be a network object that defines a subnet or a network group that includes all the addresses in the pool.

Note

For the ASA , the network group that defines the pool of "translated address" cannot be a network object that defines a subnet.

When creating these address pools, use Create or Edit ASA Network Objects and Network Groups for instructions.

For the sake of the following procedure, we named the pool of private addresses, inside_pool and name the pool of public addresses, outside_pool.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Network Object NAT.
	7.	In section 1, Type, select Dynamic and click Continue.
	8.	In section 2, Interfaces, set the source interface to inside and the destination interface to outside. Click Continue.
	9.	In section 3, Packets, perform these tasks: For the Original Address, click Choose and then select the inside_pool network object (or network group) you made in the prerequisites section above. For the Translated Address, click Choose and then select the outside_pool network object (or network group) you made in the prerequisites section above.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save.
	13.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

These are the entries that would appear in an ASA's saved configuration file as a result of these procedures.

Note

This does not apply to FDM-managed devices.

Objects created by this procedure

object network outside_pool
    range 209.165.1.1 209.165.1.255
object network inside_pool
    range 10.1.1.1 10.1.1.255

NAT rules created by this procedure

object network inside_pool
nat (inside,outside) dynamic outside_pool

Prevent a Range of IP Addresses from Being Translated When Traversing the Outside Interface

Use Case

Use this Twice NAT use case to enable site-to-site VPN.

Strategy

You are translating a pool of IP addresses to itself so that the IP addresses in one location on the network arrives unchanged in another.

Create a Twice NAT Rule

Before you begin

Create a network object or network group that defines the pool of IP addresses you are going to translate to itself. For the ASA, the range of addresses can be defined by a network object that uses an IP address range, a network object that defines a subnet, or a network group object that includes all the addresses in the range.

When creating the network objects or network groups, use Create or Edit ASA Network Objects and Network Groups for instructions.

For the sake of the following procedure, we are going call the network object or network group, Site-to-Site-PC-Pool.

Procedure

	1.	In the left pane, click Security Devices.
	2.	Click the Devices tab to locate the device or the Templates tab to locate the model device.
	3.	Click the appropriate device type tab.
	4.	Select the device you want to create the NAT rule for.
	5.	Click NAT in the Management pane at the right.
	6.	Click > Twice NAT..
	7.	In section 1, Type, select Static. Click Continue.
	8.	In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
	9.	In section 3, Packets, make these changes: Expand the Original Address menu, click Choose, and select the Site-to-Site-PC-Pool object you created in the prerequisites section. Expand the Translated Address menu, click Choose, and select the Site-to-Site-PC-Pool object you created in the prerequisites section.
	10.	Skip section 4, Advanced.
	11.	For an FDM-managed device, in section 5, Name, give the NAT rule a name.
	12.	Click Save.
	13.	For an ASA, create a crypto map. See CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide and review the chapter on LAN-to-LAN IPsec VPNs for more information on creating a crypto map.
	14.	Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Entries in the ASA's Saved Configuration File

These are the entries that would appear in an ASA's saved configuration file as a result of these procedures.

Note

This does not apply to FDM-managed devices.

Objects created by this procedure

object network Site-to-Site-PC-Pool
range 10.10.2.0 10.10.2.255

NAT rules created by this procedure

nat (inside,outside) source static Site-to-Site-PC-Pool Site-to-Site-PC-Pool

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.