Ip nat outside source static

I'm struggling to figure out why you would need the 'ip nat outside source static' command. The 'inside source static' makes perfect sense, but why the outside. In what type of scenario would you use it?
Any help would be appreciated

h1 (192.168.10.2)  -> R1 -> (ip nat inside)  R2 (ip nat outside)  -> R3 -> s1 (172.16.5.2)
On R2
ip nat outside source static 192.168.11.2  172.16.5.2
would mean -
h1 would send traffic to 192.168.11.2  and the destination IP would be translated to 172.16.5.2 and if s1 sends traffic to h1 the source IP would be 192.168.11.2.
One reason to do this would be, using the above example, your internal network uses 192.168.x.x IP addressing and you do not want to have to advertise the 172.16.5.x IP within your network.
So instead you choose an unused 192.168.x.x IP and as long as R1 routes traffic for that IP to R2 it is then translated to 172.16.5.2 on R2 which means your internal routers do not need to have external IP addresses in their routing tables.
Jon

Similar Messages

  • Question about NAT Inside Source, Inside Destination, and Outside Source

    I read the Cisco command references about "ip nat inside source", "inside destination", and "outside source", but couldn't have a clear understanding of how to associate the commands with "ip nat inside" and ip nat outside" configured for interfaces.
    Does "ip nat inside source ..." translation only happen on the interface configured as "ip nat inside"?
    Since NAT is a bidirectional action, what's the difference between "ip nat inside cource ..." and "ip nat inside destination ..."?
    I've never used "ip nat outside source ...". In what cases would it be needed?
    On an interface where there are NAT translation and also other actions such as policy map or IP Sec crypto map, would NAT happen before or after other actions?
    Thanks for help with any questions.
    Gary

    Hi Gary,
    The following documents may help you to understand some of the terminology:
    http://www.cisco.com/en/US/customer/tech/tk648/tk361/technologies_tech_note09186a0080094831.shtml
    http://www.cisco.com/en/US/customer/tech/tk648/tk361/technologies_tech_note09186a0080094837.shtml
    Also, the following document has a clear explanation of the order of operations when using NAT:
    http://www.cisco.com/en/US/customer/tech/tk648/tk361/technologies_tech_note09186a0080133ddd.shtml
    Hope that helps - pls rate the post if it does.
    Paresh

  • Nat (inside,outside) source dynamic any interface

    Hi Everyone,
    Does config below
    ASA1(config)# nat (inside,outside)  source  dynamic  any  interface
    Will do the PAT  when source is any IP  from inside interface of ASA  and going to any destination IP   address?
    Regards
    MAhesh

    Hi Mahesh,
    Yes, that NAT configuration would essentially do Dynamic PAT for any host behind the "inside" interface towards any destination address routed behind "outside" interface using the PAT IP address of "outside" interface.
    I would however suggest configuring the same NAT configuration by adding the "after-auto" parameter
    nat (inside,outside) after-auto source dynamic any interface
    What the "after-auto" parameter does is that it moves the NAT rule to the very end of the NAT rules. It will be one of the last NAT rules matched against a new connection coming from behind "inside".
    If we configured the Dynamic PAT the way you mentioned, there might be a possibility that it would override other NAT rules either now or in the future because it is at such a high priority.
    - Jouni

  • Nat (DMZ,outside) source dynamic any interface

    Hi Everyone,
    Need to confirm NAT  statement below
    nat (DMZ,outside) source dynamic any interface   in version 9.1.
    So above line means NAT from  DMZ  to outside.
    Need to know  that source here means that we are NATing IP from DMZ?
    any interface means NAT IP will be of outside interface IP?
    Regards
    MAhesh

    Hi Mahesh,
    The below NAT configuration
    nat (DMZ,outside) source dynamic any interface
    Means the following
    The NAT configuration is for connection between "DMZ" and "outside".  Basicly for connection FROM "DMZ" to "outside"
    The translation is a "dynamic" translation
    It accepts "any" source address from behind the "DMZ" interface
    It uses the "outside" "interface" IP address as the PAT address
    So its a basic Dynamic PAT translations for the hosts behind "DMZ" interface and accepts any source address/network you might have behind "DMZ"
    - Jouni

  • I have an iMac5,1 with an intel processor.  For the last month or so, whenever I play a video from an outside source - e.g. YouTube, the picture jumps and breaks-up.  All of my software is up-to-date.  Any thoughts on how to fix this problem?

    I have an iMac5,1 with an intel processor.  For the last month or so, whenever I play a video from an outside source - e.g. YouTube, the picture jumps and breaks-up.  All of my software is up-to-date.  Any thoughts on how to fix this problem?

    You're welcome. As to checking speed go to http://speedtest.net/ and it will choose the closest server for you. BTW, whatever you do, don't click on the robot icon that says "Start Scan" or MacKeeper below that. Only use the speed test in the middle that has the button BEGIN TEST on it. It will run a download speed test first and then an upload speed test. The download test will give a much faster response.

  • Creating Node data on Author server from outside source?

    I was wondering if it is possible to create node data on the author server from an outside source such as the publish server, without using reverse replication?
    IE,
    User accessing form page on publish server, enters data, submits the form. Which somehow would create node data directly on the author server without storing any data on the publish server.
    Is this even possible?
    Thanks

    Thank you for all the responses.
    Yes I do agree that not using reverse replication as the system is designed is not exactly a wise design choice. The problem I am facing is that the end user generated content is security sensitive and cannot be store on the publish instance. (Even temporarily)
    I have managed to write a servlet on the Author server to accept the post data and create node data on the Author repository.
    However to do this, I have had to disable login/security on the Author server for the servlet path (IE /bin/posthandlerservlet ) so that the author servlet can be accessed from the outside. Firewall has also been adjusted to let traffic through as well.
    Now my remaining question would be, is opening up this path to the Author server much more dangerous and less secure that creating the node data on the Publish server in a place that protected access? We are really worried that the node created data on the publish server could somehow be accessed by end users in the event of a security problem.

  • Client NAT and Source IP Sticky

    How can we implement client NAT and source IP sticky for the same server farm without running into issues? Our NAT pool is using IPs from the VIPs' subnet. Is this possible? This configuration is on Cat 6500 w/ CSM-S v. 2.1.1. Thanks.

    this is possible.
    The CSM will first determine the destination server based on the client ip and the sticky srcip table and then it will nat the client ip address using your pool.
    It does not matter which subnet is being used as long as the servers know to respond back to the CSM.
    Regards,
    Gilles.

  • Flash drive new version 11. ask for outside source to store files on pc.

    new version of flash drive adobe 11 ask for outside source. if they could file on my computer. new version came with mac a fee securty . i have a virus protection allredy . my knowlege u can not run to virus program.

    Re: McAfee - you're right. Two A/V programs is bad. Uninstall McAffee.
    Re: Storage. In order to view Flash content (videos or games), you NEED to allow a small amount of data to be stored in your temp folder, to prevent the content from constantly stopping and restarting. As always, if you have ANY reason to be suspicious of a site you're visiting, then you have reason the be suspicious of what it may want to store on your system but for the most part, Flash data is video "buffering" content and nothing more.

  • I purchased and downloaded to ring tones from an outside source (no the App store).  How do I get these into my Sounds in Settings so I can use them?

    I purchased and downloaded two ring tones from an outside source (not through the App Store).  How do I get these loaded into the Sounds on my Settings so I can use them?

    Some apps that you download on your iPhone may possibly be to new for the iPod touch 2nd gen. I have a iPhone 5 and a iPod touch 2nd generation myself. If you plug his ipod into iTunes and restore it from a backup of your iPhone than it will download the paid apps and music that are compatible with his ipod. Hope this helps.

  • I need to count intermitte​nt high speed pulses from an outside source with cFP-CTR-50​2 and labview.

    I need to count intermittent high speed pulses from an outside source with cFP-CTR-502 and Labview 8.2 . I've found example code for generating pulses and creating intricate count setups but no straightforward examples of a simple counter. Any suggestions?

    Hello tinfish,
    I could not find a simple example that implements simple counting either, but it should be straightforward enough for us to try. Do you have the CTR module configured properly in MAX? If so, can you monitor the channels on your CTR 502 for input? Try connecting a square wave or some other digital pulse to the terminal to test the functionality of the counter module first (before programming). If you monitor the input channels with somethign connected you should see the count increment each time it sees a rising edge (assuming default configuration).
    Once you've verified that everything works in MAX, you can set up your CTR module in a LV 8.2 project. If you need help with this, refer to the help document (look in the "Configuring FieldPoint in LabVIEW" section):
    C:\Program Files\National Instruments\FieldPoint\documentation\Online Help\fplv.chm
    You should be able to just read a channel tag from your CTR 502 using an FP Read VI. (Simply drag the channel from your project onto the block diagram). Since counting is the default behavior of the 502, there is no special programming involved to make it work.
    I hope this helps -- if it's too high-level we can talk details about specific questions you have.  Have a good one!
    Charlie S.
    Visit ni.com/gettingstarted for step-by-step help in setting up your system

  • Access log4j.properties outside source folder

    Hi,
    I have developed a standalone java application, for logging the application i have created a log4j.properties in the source folder.
    it is woring fine and the logs are created as specified in the properties file.
    Issue:
    i have created a jar which contains the complete source code and log4j.properties file.
    if i try to create a jar without log4j.properties since the properties file will change by customer frequantly, i need to keep the log4j.properties outside the source folder.
    but my jar is unable to access the log4j.properties when i try to run the appplication.
    Question:
    how do we access the log4j.properties from outside source folder?
    thanks,
    J R

    gimbal2 wrote:
    T.PD wrote:
    In addition what gimbal2 sad: Do you create a MANIFEST.MF file in your jar?
    If so you should add (or extend) the ClassPath entry to include the current directory ( *.* ) so you can have the log4j.properties file in the folder where you call your jar from:[...]This is very dangerous. It makes the path not relative to where the jar is, but to where you invoke the java command.The OP's request is to have the (log4j) properties file outside of the jar maybe for easier editing.
    Adding any known folder in the file system to the class path is the only way I know to achieve this (Do you know better?). Folliwing this you could try to guess paths to add hoping that they will exist on all Systems you will use and place the properties file(s) there. On the other hane the current working dir the java command is invoked in is perdictable. Usually it's the directory the jar itself is located...
    I agree that this solution can be dangerous and opens the possibility to access classes located in a valid package structure below current working dir . But if you add the ' *.* ' as the last entry in your classpath at least the classes from all your other jars are accessed first...
    bye
    TPD

  • Nat (outside,outside) dynamic interface, equivalent in IOS

    For a remote vpn user who just want to access the internet for now. now I know you have to put the following in config when using ASA, what is the equivalent in IOS?
    nat (outside,outside) dynamic interface.
    thanks,
    Han

    Hello.
    I think you wanted to achieve hairpinning for the ipsec remote access vpn users to access internet via vpn router..There is no direct way of doing this like we have in ASA.
    Please follow the below cisco document where you can make use of nat on a stick configuration to achieve.. this
    http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml
    Regards
    Harish
    Please rate helpful posts!

  • Is it possible to save texts from Droid 2 Global to an outside source or sd?

    I have texts on my Droid 2 Global that I need to keep for legal purposes (conversation with my child's father, my ex).  Is there some way to save them to an outside source or sd card?  Or can I sync them with my computer?  Please help!

    You can back them up to a PC with VeryAndroid SMS Backup with instruction at http://www.veryandroid.com/pctool-for-sms-backup/how-to-backup-sms-from-android-on-computer--with-pc-tool-for-sms-backup.html
    Android App at https://play.google.com/store/apps/details?id=com.veryandroid.smsbackup&feature=search_result#?t=W251bGwsMSwyLDEsImNvbS52ZXJ5YW5kcm9pZC5zbXNiYWNrdXAiXQ..
    Try this one for free... http://www.wondershare.com/mobile-phone/android-sms-backup.html

  • Loadable firmware, kernel build outside source and patching

    Greetings -- which package do I need to get Atmel wifi loadable firmware?
    On SuSE and Gentoo, I see the module firmware_class loaded.  How do I know Arch kernel has it compiled in/or not, and how do I recompile the kernel with loadable firmware support if necessary? 
    When I do it, I like to compile my kernel outside source with make O=/build/dir menuconfig in source once, and make oldconfig, make in /build/dir afterwards.  How does one recompile the kernel on Arch, and is the above compatible?
    I also like the vesafb-ng patch, reiser4, and some other kernel patches -- how do we do that on Arch?

    braver wrote:
    Greetings -- which package do I need to get Atmel wifi loadable firmware?
    On SuSE and Gentoo, I see the module firmware_class loaded.  How do I know Arch kernel has it compiled in/or not, and how do I recompile the kernel with loadable firmware support if necessary? 
    When I do it, I like to compile my kernel outside source with make O=/build/dir menuconfig in source once, and make oldconfig, make in /build/dir afterwards.  How does one recompile the kernel on Arch, and is the above compatible?
    I also like the vesafb-ng patch, reiser4, and some other kernel patches -- how do we do that on Arch?
    What amtel chipset? at76c503a-cvs is in unstable.
    If you want vesafb-tng and reiser4, and other patches, see kernel26beyond. vesafb-tng may be back in 2.6.20...
    James

  • Anyone know if there is an adapter to record audio from an outside source in real time to an iphone 4s or 5s video?

    Anyone know if there is an adapter to record audio from an outside source in real time to an iphone 4s or 5s video?

    Hi @imobl,
    You sound like an Apple support guy who hasn't been able to answer my questions.
    To respond to some of the points you made,
    - I did not ignore Ocean20's suggestion. If you has read my post, you would have known that I took my phone to the apple service centre where they tried this restore on THEIR machines. I am assuming that Apple guys know how not to block iTunes. So I actually do not understand your point about me trying the hosts file changes on my machine. Do you not believe that apple tested this issue with the correct settings?
    - you also give a flawed logic of why the issue is a hardware issue. You mentioned that If I thought that the issue was with the software, i should try a restore and getting it to work. The problem is that my error (23), and many others comes up when the restore fails. And you would be astonished to know that not all errors are hardware errors. Sometimes even software errors prevent restores. Funnily enough Apple itself mention that 'in rare cases, error 23 could be hardware related'.
    - all Apple has done so far is replicate the issue. I don not know how anyone can conclude that the issue is a hardware issue.
    And by the way, I am not certain that this is a software bug. Again if you read my Posts, you will notice I only want a confirmation,/proof that the issue is hardware related as they mention..
    Please refrain do. Responding if there is nothing to add.

Maybe you are looking for