Avatar of beardog1113
beardog1113Flag for China asked on

Cisco ASA 8.4 "few to many" nat question

hello expert
my ASA configuration as below:
object network test_internal
object network test_external
object network test_pat

nat (inside,outside) source dynamic test_internal test_external
nat (inside,outside) source dynamic test_internal pat-pool test_pat

while one host of 10.1.1.x access to internet it will mapped to one of 203.94.35.x, absolutely real IP is less than mapped IP pools.
my question is: does it possible configure some parameter on the ASA, the mapped IP address could being changed frequently while hosts access to internet?

thank you

Avatar of undefined
Last Comment

8/22/2022 - Mon

mapped IP is when you have applications that really need to have connections from the internet opened to them.  dynamic mapped IP's are fairly rare and are still usually for that purpose because of the way the protocol works its using; VoIP is a good example.

So if you want a "mapped IP" to "frequently" switch between internal hosts I would recommend just doing a straight PAT.  The reason is that if you change the mapping of the IP before the client may be done with it completely then you'll break the app that might need it; which makes believe you don't have an app that requires this feature.  So I would just do static mapped IPs on servers and stay with PAT for anything that isn't a server.

Or is there an application requirement that requires you to have mapped IPs on clients.  Or if you don't have enough public IPs to go around for your servers, just do static PAT for those and static NAT (mapped IP) for those that truly need it (like an email server would be a good example; web server not so much).

i have few host but with much enough public IP, i don't need access from internet to my host, i just need hosts access to internet, mapped IP address could being changed frequently.
for example, once host initiate a connection to google.com, mapped address is using
but at the same time this host initiate a connection to microsoft.com, mapped address is using, and so on.

thank you

ok, in that case, forget the nat statements you have and just use simple outside interface PAT.  Since you're using 8.3+ code, you need to use a config like the following:

object network inside_lan
    nat (inside,outside) dynamic interface

This will PAT all of the internal hosts to the IP assigned to your outside interface.  This is a very common way for providing internet access to inside hosts that have non-routable IPs.
Experts Exchange has (a) saved my job multiple times, (b) saved me hours, days, and even weeks of work, and often (c) makes me look like a superhero! This place is MAGIC!
Walt Forbes

if i am using your configuration, mapped IP address only be IP of outside interface right?
i need the mapped IP could changed randomly.

any advice?


yes, it would only map via PAT to the outside interface IP.  I don't believe you can specify multiple dynamic PAT addresses; at least I can't find an example of that.  The only thing you can do is have a dynamic NAT pool with a dynamic PAT address as a backup.  But you can't have a "mapped IP" change randomly.

What is the reason that you to have multiple PAT addresses for your inside hosts?  Sorry, but I don't understand the technical reason for what you're describing.  It sounds like what you're trying to do is overkill to be honest, but I'm not sure I completely understand what you're trying to accomplish.

thats correct i have multiple addresses to be used as PAT pool, my requirement is:
for example once an inside host going to access www.google.com the ASA using public_address_1, if the host access to www.microsoft.com the ASA using public_address_2, of course public_address_1 and 2 are in PAT pool.
are you clear about my description?

thank you
Get an unlimited membership to EE for less than $4 a week.
Unlimited question asking, solutions, articles and more.

Log in or sign up to see answer
Become an EE member today7-DAY FREE TRIAL
Members can start a 7-Day Free trial then enjoy unlimited access to the platform
Sign up - Free for 7 days
Learn why we charge membership fees
We get it - no one likes a content blocker. Take one extra minute and find out why we block content.
See how we're fighting big data
Not exactly the question you had in mind?
Sign up for an EE membership and get your own personalized solution. With an EE membership, you can ask unlimited troubleshooting, research, or opinion questions.
ask a question

thanks, this looks like reasonable, i will test it.