Cisco Systems ASA 5580 Manual De Usuario

The following example maps a host address to itself using a network object:

ciscoasa(config)# object network my-host-obj1-identity

ciscoasa(config-network-object)# host 10.1.1.1

ciscoasa(config-network-object)# object network my-host-obj1

ciscoasa(config-network-object)# host 10.1.1.1

ciscoasa(config-network-object)# nat (inside,outside) static my-host-obj1-identity

By default, all TCP PAT traffic and all UDP DNS traffic uses per-session PAT. To use multi-session PAT 
for traffic, you can configure per-session PAT rules: a permit rule uses per-session PAT, and a deny rule 
uses multi-session PAT. For more information about per-session vs. multi-session PAT, see the 

By default, the following rules are installed:

xlate per-session permit tcp any4 any4

xlate per-session permit tcp any4 any6

xlate per-session permit tcp any6 any4

xlate per-session permit tcp any6 any6

xlate per-session permit udp any4 any4 eq domain

xlate per-session permit udp any4 any6 eq domain

xlate per-session permit udp any6 any4 eq domain

xlate per-session permit udp any6 any6 eq domain

You cannot remove these rules, and they always exist after any manually-created rules. Because rules 
are evaluated in order, you can override the default rules. For example, to completely negate these rules, 
you could add the following:

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain