Cisco FirePOWER ASA 5500 series

17-6
Cisco Security Appliance Command Line Configuration Guide
OL-10088-01
Chapter 17 Applying NAT
NAT Overview
Figure 17-5 Remote Host Attempts to Connect to the Real Address
Figure 17-6 shows a remote host attempting to initiate a connection to a mapped address. This address
is not currently in the translation table, so the security appliance drops the packet.
Figure 17-6 Remote Host Attempts to Initiate a Connection to a Mapped Address
Note For the duration of the translation, a remote host can initiate a connection to the translated host if an
access list allows it. Because the address is unpredictable, a connection to the host is unlikely. However
in this case, you can rely on the security of the access list.
Web Server
www.example.com
Outside
Inside
209.165.201.2
10.1.2.1
10.1.2.27
Translation
209.165.201.1010.1.2.27
10.1.2.27
Security
Appliance
132216
Web Server
www.example.com
Outside
Inside
209.165.201.2
10.1.2.1
10.1.2.27
Security
Appliance
209.165.201.10
132217