26-10
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 26 Information About NAT
NAT Types
Note For the duration of the translation, a remote host can initiate a connection to the translated host if an
access rule allows it. Because the address is unpredictable, a connection to the host is unlikely.
Nevertheless, in this case you can rely on the security of the access rule.
Dynamic NAT Disadvantages and Advantages
Dynamic NAT has these disadvantages:
• If the mapped pool has fewer addresses than the real group, you could run out of addresses if the
amount of traffic is more than expected.
Use PAT if this event occurs often because PAT provides over 64,000 translations using ports of a
single address.
• You have to use a large number of routable addresses in the mapped pool; if the destination network
requires registered addresses, such as the Internet, you might encounter a shortage of usable
addresses.
The advantage of dynamic NAT is that some protocols cannot use PAT. PAT does not work with the
following:
• IP protocols that do not have a port to overload, such as GRE version 0.
• Some multimedia applications that have a data stream on one port, the control path on another port,
and are not open standard.
See the “When to Use Application Protocol Inspection” section on page 36-2 for more information about
NAT and PAT support.
Dynamic PAT
This section describes dynamic PAT and includes the following topics:
• Information About Dynamic PAT, page 26-10
• Dynamic PAT Disadvantages and Advantages, page 26-11
Information About Dynamic PAT
Dynamic PAT translates multiple real addresses to a single mapped IP address by translating the real
address and source port to the mapped address and a unique port above 1024. Each connection requires
a separate translation session because the source port differs for each connection. For example,
10.1.1.1:1025 requires a separate translation from 10.1.1.1:1026.
To Next Page
Loading...
Need help?
General
