3
Yes, you can certainly configure a Static PAT on a Cisco ASA. Typically this is done using AutoNAT:
Within an object definition, this is the syntax you would use:
nat (<REAL-INTF>, <MAPPED-INTF>) static <MAPPED-IP> [service <tcp|udp> <REAL-PORT> <MAPPED-PORT>]
There is also a way to do it with Manual NAT syntax, but ...
2
There are (at least) two main reasons:
The assumption is that you control the "inside" network. So,
presumably, you're not doing the spoofing.
Not every device needs to be NATted. You might have some devices
that use addresses that don't need translation.
1
The PATing device uses a combination of IP address and port to create a map of unique entries, allowing it to understand what traffic belongs to which device.
The port allocation needs to be able to account for multiple connections to the same service over the same port. This is critical for traffic that uses the same source and destination like NTP.
...
Only top voted, non community-wiki answers of a minimum length are eligible
