Cisco ASA NAT Configuration

Cisco ASAIntermediate

Configure NAT on a Cisco ASA: dynamic PAT for outbound internet access, static NAT for DMZ servers, and NAT exemption for VPN traffic.

↓ example.txt

What is it?

NAT (Network Address Translation) on the Cisco ASA translates private IP addresses to public ones. There are three main types: Dynamic PAT (Port Address Translation) — many internal users share one public IP for outbound internet access; Static NAT — maps a public IP to a private server so it's reachable from the internet; NAT Exemption (identity NAT) — tells the ASA NOT to translate specific traffic, required for VPN tunnels. ASA processes NAT rules in order: manual NAT (section 1) → auto NAT (section 2) → after-auto NAT (section 3).

✓ When to use

·Dynamic PAT: always needed for internal users to access the internet with private IPs
·Static NAT: when you have a DMZ server (web, mail, FTP) that must be reachable from the internet
·NAT Exemption: required whenever you have a site-to-site VPN — prevents VPN traffic from being NATted
·Port forwarding: when you want to expose a single service (port 443) on a public IP to a private server

✗ When NOT to use

·Between internal VLANs of the same organization — route between them without NAT
·For VPN traffic — use NAT exemption instead to preserve original IP addresses

How it compares

vs Static NAT vs Port ForwardingStatic NAT translates the entire IP in both directions (all ports). Port forwarding (static PAT) translates only a specific port. Use static NAT when a server needs to be fully reachable; use port forwarding for single services.

vs ASA NAT vs IOS NATASA NAT uses objects and a section-based processing order (1, 2, after-auto). IOS NAT uses 'ip nat inside source' with route-maps. Conceptually similar but different syntax. ASA is more flexible for complex scenarios.

Prerequisites

→All interfaces must be named (nameif) before configuring NAT
→Objects must be defined before referencing them in NAT rules
→NAT rules are processed top to bottom within each section — order matters
→VPN NAT exemption rules must be in section 1 (manual NAT) to take priority over dynamic PAT

Config Generator

Inside Interface *

Outside Interface *

DMZ Interface

Leave empty if no DMZ

Inside Network *

Outside IP (for PAT) *

The public IP on the outside interface — used as the PAT address

DMZ Servers (Static NAT)

VPN Exempt Networks (no NAT)

Verification commands

show nat

Show all NAT rules with hit counts and translated packets

Expected: Each rule shows 'translate hits' counter. Zero hits = rule never matched. Check order and object definitions.

show nat detail

Detailed NAT table with objects and translations

Expected: Shows the expanded objects and which IPs are being translated

show xlate

Show active NAT translations (connection table)

Expected: Lists current active translations. If a translation is missing, the NAT rule may not be matching.

show conn

Show active connections — useful to verify traffic is flowing post-NAT

Expected: Lists established connections with translated and original IPs

Debug commands

packet-tracer input inside tcp 192.168.1.10 12345 8.8.8.8 443 detailed

Trace a packet from inside to internet and show which NAT rule applies

⚠ Simulation only — no real traffic sent. Shows exact NAT translation applied.

Common mistakes & fixes

⚡ Internal users cannot access the internet

Cause: Dynamic PAT rule missing or not matching, or default route not configured on outside interface

Fix: Verify 'show nat' shows the PAT rule with hits. Check 'show route' for a default route (0.0.0.0/0) pointing out the outside interface.

⚡ DMZ server not reachable from internet

Cause: Static NAT rule missing, wrong public IP, or ACL blocking inbound traffic on outside interface

Fix: Verify static NAT with 'show nat detail'. Check the outside ACL permits the traffic: 'show access-list'. Use packet-tracer to diagnose.

⚡ VPN traffic being NATted instead of going through the tunnel

Cause: NAT exemption rule missing or in wrong section — the dynamic PAT rule is matching before the exemption

Fix: NAT exemption must be in section 1 (manual NAT with line number 1). Verify with 'show nat' — exemption rule must appear BEFORE the PAT rule.

⚡ Asymmetric NAT — one direction translates, other doesn't

Cause: NAT rule specifies only one direction, or interface names are swapped in the NAT statement

Fix: Check interface pair in the NAT rule: nat (REAL_INTERFACE, MAPPED_INTERFACE). For bidirectional static NAT, the ASA handles both directions automatically.