Cisco Systems and the ASA Services Module Manual De Usuario

ciscoasa(config-network-object)# host 10.10.10.21

ciscoasa(config-network-object)# object-group network nat-pat-grp

ciscoasa(config-network-object)# network-object object nat-range1

ciscoasa(config-network-object)# network-object object pat-ip1

ciscoasa(config-network-object)# object network my_net_obj5

ciscoasa(config-network-object)# subnet 10.76.11.0 255.255.255.0

ciscoasa(config-network-object)# nat (inside,outside) dynamic nat-pat-grp interface

The following example configures dynamic NAT with dynamic PAT backup to translate IPv6 hosts to 
IPv4. Hosts on inside network 2001:DB8::/96 are mapped first to the IPv4_NAT_RANGE pool 
(209.165.201.1 to 209.165.201.30). After all addresses in the IPv4_NAT_RANGE pool are allocated, 
dynamic PAT is performed using the IPv4_PAT address (209.165.201.31). In the event that the PAT 
translations are also used up, dynamic PAT is performed using the outside interface address.

ciscoasa(config)# object network IPv4_NAT_RANGE

ciscoasa(config-network-object)# range 209.165.201.1 209.165.201.30

ciscoasa(config-network-object)# object network IPv4_PAT

ciscoasa(config-network-object)# host 209.165.201.31

ciscoasa(config-network-object)# object-group network IPv4_GROUP

ciscoasa(config-network-object)# network-object object IPv4_NAT_RANGE

ciscoasa(config-network-object)# network-object object IPv4_PAT

ciscoasa(config-network-object)# object network my_net_obj5

ciscoasa(config-network-object)# subnet 2001:DB8::/96

ciscoasa(config-network-object)# nat (inside,outside) dynamic IPv4_GROUP interface

This section describes how to configure network object NAT for dynamic PAT (hide). For more 
information, see the 

.

For a PAT pool:

If available, the real source port number is used for the mapped port. However, if the real port is not 
available, by default the mapped ports are chosen from the same range of ports as the real port 
number: 0 to 511, 512 to 1023, and 1024 to 65535. Therefore, ports below 1024 have only a small 
PAT pool that can be used. (8.4(3) and later, not including 8.5(1) or 8.6(1)) If you have a lot of traffic 
that uses the lower port ranges, you can now specify a flat range of ports to be used instead of the 
three unequal-sized tiers: either 1024 to 65535, or 1 to 65535.

If you use the same PAT pool object in two separate rules, then be sure to specify the same options 
for each rule. For example, if one rule specifies extended PAT and a flat range, then the other rule 
must also specify extended PAT and a flat range.

For extended PAT for a PAT pool:

Many application inspections do not support extended PAT. See the 

 for a complete list of unsupported inspections.