Cisco Systems ASA 5585-X Manual De Usuario

 shows a typical many-to-few static NAT scenario.

Instead of using a static rule this way, we suggest that you create a one-to-one rule for the traffic that 
needs bidirectional initiation, and then create a dynamic rule for the rest of your addresses.

This section describes dynamic NAT and includes the following topics:

Dynamic NAT translates a group of real addresses to a pool of mapped addresses that are routable on the 
destination network. The mapped pool typically includes fewer addresses than the real group. When a 
host you want to translate accesses the destination network, the ASA assigns the host an IP address from 
the mapped pool. The translation is created only when the real host initiates the connection. The 
translation is in place only for the duration of the connection, and a given user does not keep the same 
IP address after the translation times out. Users on the destination network, therefore, cannot initiate a 
reliable connection to a host that uses dynamic NAT, even if the connection is allowed by an access rule.

 shows a typical dynamic NAT scenario. Only real hosts can create a NAT session, and 

responding traffic is allowed back.

Inside

Outside

Security
Appliance

24

8

770

Inside

Outside

1

3

00

3

2

Security
Appliance