! PermitANY — Cisco ASA NAT Configuration
! Configure NAT on a Cisco ASA: dynamic PAT for outbound internet access, static NAT for DMZ servers, and NAT exemption for VPN traffic.
! Generated: 2026-09-21
! These are EXAMPLE values. Replace with your actual config before deploying.
!
! ── Objects ──────────────────────────────────────────
object network INSIDE_NET
 subnet 192.168.1.0 255.255.255.0
!

object network WEB_SERVER
 host 10.10.10.10
!

! ── Dynamic PAT — inside users to internet ───────────
nat (inside,outside) after-auto source dynamic INSIDE_NET interface
!

! ── Static NAT — WEB_SERVER ─────────────────────────────
object network WEB_SERVER
 nat ({{../dmz_interface}},{{../outside_interface}}) static 203.0.113.10 service tcp 443 443
!


! ── NAT Exemption for VPN ────────────────────────────
object network VPN_REMOTE_{{@index}}
 subnet 10.2.0.0 255.255.255.0
nat ({{../../inside_interface}},{{../../outside_interface}}) 1 source static INSIDE_NET INSIDE_NET destination static VPN_REMOTE_{{@index}} VPN_REMOTE_{{@index}} no-proxy-arp
!