Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-32
Cisco ASA Series CLI Configuration Guide
Chapter 1 Information About NAT
DNS and NAT
Because you want inside users to use the mapped address for ftp.cisco.com (2001:DB8::D1A5:C8E1)
you need to configure DNS reply modification for the static translation. This example also includes a
static NAT translation for the DNS server, and a PAT rule for the inside IPv6 hosts.
Figure 1-25 DNS64 Reply Modification Using Outside NAT
ftp.cisco.com
209.165.200.225
IPv4 Internet
IPv6 Net
Static Translation on Inside to:
2001:DB8::D1A5:C8E1
PAT Translation on Outside to:
209.165.200.230
User:
2001:DB8::1
DNS Server
209.165.201.15
Static Translation on Inside to:
2001:DB8::D1A5:C90F
1
2
7
6
5
4
3
DNS Query
ftp.cisco.com?
DNS Reply
209.165.200.225
DNS Reply Modification
209.165.200.225 2001:DB8::D1A5:C8E1
DNS Reply
2001:DB8::D1A5:C8E1
FTP Request
209.165.200.225
Dest Addr. Translation
209.165.200.2252001:DB8::D1A5:C8E1
FTP Request
2001:DB8::D1A5:C8E1
Security Device
333368

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English