ASA Static one to one NAT on a range of addresses

It is possible to implement static Network Address Translation (NAT) on a range of IP addresses on a Cisco ASA rather than on a single IP address. This can be achieved by defining a whole subnet when implementing NAT.

The following is an example of how this can be achieved:

ASA1(config)# object network PUBLIC_POOL ASA1(config-network-object)# subnet

First we configure the pool with IP addresses. Our next step is to create a network object for the DMZ subnet and to enable NAT:

ASA1(config)# object network DMZ ASA1(config-network-object)# subnet ASA1(config-network-object)# nat (DMZ,OUTSIDE) static PUBLIC_POOL

The configuration above tells the ASA to translate any IP address from the subnet DMZ ( /24) to an IP address in the PUBLIC_POOL ( /24).

Last but not least, let’s make the access-list:

ASA1(config)# access-list OUTSIDE_TO_DMZ permit tcp any

and activate it on the outside:

ASA1(config)# access-group OUTSIDE_TO_DMZ in interface OUTSIDE

Such a configuration will result in the translation of addresses such that the last octet is always the same. For example: --> --> --> and so on.