Advanced NAT configurations

 In this section, we are going to a take a look at both static and dynamic NAT, exploring their purpose and configurations.

Static NAT

Static NAT is generally used to provide access from the Outside zone, such as the internet, to a server on the DMZ of your corporate network.

Let's observe the following topology, there's one server on the DMZ, assuming its IP address is 172.16.1.50, however, users on the internet would require access to the server and the FTP service:

To configure static NAT on the ASA using the CLI, the following steps will guide us through the process:

1. Create a network object, add the server as an object, and create the NAT rule:

ASA-1(config)# object network DMZ-SVR
ASA-1(config-network-object)# host 172.16.1.50
ASA-1(config-network-object)# nat (dmz,outside) static 200.1.1.1
ASA-1(config-network-object)# exit

2. Create an Extended ACL to permit IP traffic from anywhere to the server only:

ASA-1(config)# access-list Out-DMZ extended permit ip any host...