I've run into this config on Cisco firewall:

nat (IFNAME1) 99 outside

global (IFNAME2) 99 netmask

It looks like an ok PAT config that would translate IP address of packets coming on interface IFNAME1 then they go out through IFNAME2.

Could someone explain to me what does the keyword "outside" at the end of 1st line nat statement mean? Because all the examples I've found online do not have this "outside" keyword. Maybe it allows reverse translation if packets would come to IFNAME2?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 16, 2017 at 21:39

2 Answers 2


It's NAT to outside interface. So all packets would be rewritten with IP assigned to outside interface.

  • What do you mean by all packets? Packets coming to interface IFNAME1 and going to IFNAME2? As you can see in the config the pair (99) of two statements are used in PIX PAT and those lines define that all packets coming to IFNAME1 and going out of IFNAME2 will be translated to Well at least, that would be the case without "outside" keyword. cisco.com/c/en/us/support/docs/security/… Feb 12, 2017 at 19:00
  • Cisco documentation for PIX 7.0: In order to use dynamic outside NAT for a DMZ network hostname(config)#nat (dmz) 1 outside. Global in yours example is just exempt from NAT. Feb 13, 2017 at 0:26
  • No you are wrong. It is used for what I've guest in my original question. Stop writing misleading comments. Feb 13, 2017 at 14:03
  • Check PIX 7.x documentation. Especially bit starting with "In order to use dynamic outside NAT for a DMZ network, and exempt another DMZ network, enter this command:" Pretty same scenario, but exempt is done with access-list. cisco.com/c/en/us/support/docs/security/… Feb 14, 2017 at 16:56

This type of NAT with outside at the end of nat command called outside NAT. For outside NAT (from low security level to higher security level), you need to use the outside keyword in the nat command. Because if NAT control enabled you can't pass traffic from lower to higher security level without nat configured. For example for DMZ hosts to communicate with insude hosts ,nat outside should be configured

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.