Monday, September 9, 2013

Configuring ASA NAT - Dynamic NAT - Object Network NAT

In this blogtorial we will see how we can take an inside LAN subnet and dynamically NAT using a POOL of addresses. Make sure the pool of addresses being used is reachable from the destination.

Here is the topology and the entire config can be downloaded here.

Inside LAN ( subnet should be dynamically translated to one of the IP addresses from the POOL ( 
First thing we need to do is to configure the interfaces (inside/outside) of the ASA. 

 interface GigabitEthernet0  
  nameif inside-int 
  !!Security Level should be set to something higher than the outside interface. I set it to
  !!0 here because I didn't want to mess around with ACLs. 
  security-level 0  
  ip address  
 interface GigabitEthernet1  
  nameif outside-int  
  security-level 0  
  ip address  

Let's get R1 configured so we have something outside of the ASA to send traffic to.

 !!Set up the interface
 interface FastEthernet1/0  
  description connected_to_asa  
  ip address  
  duplex auto  
  speed auto  
 !!Set up a static route so R1 has a route back to the ASA NAT POOL   
 ip route  

Alright now let's move on to the actual NAT config on the ASA.

 !!Create an object referencing the range of outside addresses that the inside IPs 
 !!!are translated to.
 object network my-range-obj  
 !!Create an object referencing the range of inside addresses and apply the NAT command.   
 object network my-inside-net  
 !!NAT inside interface range specified above dynamically to the object "my-range-obj" 
  nat (inside,outside) dynamic my-range-obj  

Now ASA will dynamically convert anything coming from to one of the POOL addresses (

Let's verify by pinging from a host inside (in this case it is to the IP on R1.

As you can see pinging from is translated to an IP address in the range.

Many more articles to come so stay tuned.

Please reshare/subscribe/comment/+1 if you like my posts as it keeps me motivated to write more and spread the knowledge.


  1. Useful tips. thx for your knowledge sharing.

  2. I tried , but found couple of issues as follows ,
    1. Can ping from local pc to ASA not backward
    2. cannot ping from local pc to router ip -
    3.Tthis command is not recognized " nat (inside,outside) dynamic my-range-obj "