Cisco ASA 8.4 "few to many" nat question

mapped IP is when you have applications that really need to have connections from the internet opened to them.  dynamic mapped IP's are fairly rare and are still usually for that purpose because of the way the protocol works its using; VoIP is a good example.

So if you want a "mapped IP" to "frequently" switch between internal hosts I would recommend just doing a straight PAT.  The reason is that if you change the mapping of the IP before the client may be done with it completely then you'll break the app that might need it; which makes believe you don't have an app that requires this feature.  So I would just do static mapped IPs on servers and stay with PAT for anything that isn't a server.

Or is there an application requirement that requires you to have mapped IPs on clients.  Or if you don't have enough public IPs to go around for your servers, just do static PAT for those and static NAT (mapped IP) for those that truly need it (like an email server would be a good example; web server not so much).

hello
i have few host but with much enough public IP, i don't need access from internet to my host, i just need hosts access to internet, mapped IP address could being changed frequently.
for example, once host 10.1.1.200 initiate a connection to google.com, mapped address is using 203.94.35.4
but at the same time this host initiate a connection to microsoft.com, mapped address is using 203.94.35.5, and so on.

thank you

ok, in that case, forget the nat statements you have and just use simple outside interface PAT.  Since you're using 8.3+ code, you need to use a config like the following:

object network inside_lan
    subnet 10.1.1.0 255.255.255.0
    nat (inside,outside) dynamic interface


This will PAT all of the internal hosts to the IP assigned to your outside interface.  This is a very common way for providing internet access to inside hosts that have non-routable IPs.

hello
if i am using your configuration, mapped IP address only be IP of outside interface right?
i need the mapped IP could changed randomly.

any advice?

thanks

yes, it would only map via PAT to the outside interface IP.  I don't believe you can specify multiple dynamic PAT addresses; at least I can't find an example of that.  The only thing you can do is have a dynamic NAT pool with a dynamic PAT address as a backup.  But you can't have a "mapped IP" change randomly.

What is the reason that you to have multiple PAT addresses for your inside hosts?  Sorry, but I don't understand the technical reason for what you're describing.  It sounds like what you're trying to do is overkill to be honest, but I'm not sure I completely understand what you're trying to accomplish.

hello
thats correct i have multiple addresses to be used as PAT pool, my requirement is:
for example once an inside host going to access www.google.com the ASA using public_address_1, if the host access to www.microsoft.com the ASA using public_address_2, of course public_address_1 and 2 are in PAT pool.
are you clear about my description?

thank you

thanks, this looks like reasonable, i will test it.