Cisco
Login
Search

Get Started Common Use Cases for NAT Prevent a Range of IP Addresses from Being Translated When Traversing the Outside Interface Create a Twice NAT Rule

Last updated: Jun 09, 2025

Create a Twice NAT Rule

Before you begin

Create a network object or network group that defines the pool of IP addresses you are going to translate to itself. For the ASA, the range of addresses can be defined by a network object that uses an IP address range, a network object that defines a subnet, or a network group object that includes all the addresses in the range. For the FTD, the range of addresses can be defined by a network object that defines a subnet or a network group object that includes all the addresses in the range.

When creating the network objects or network groups, use Create or Edit a Firepower Network Object or Network Group for instructions.

For the sake of the following procedure, we are going call the network object or network group, Site-to-Site-PC-Pool.

Procedure

1

In the left pane, click Security Devices.
2

Click the Devices tab to locate the device or the Templates tab to locate the model device.
3

Click the appropriate device type tab.
4

Select the device you want to create the NAT rule for.
5

Click NAT in the Management pane at the right.
6

Click > Twice NAT..

7

In section 1, Type, select Static. Click Continue.
8

In section 2, Interfaces, choose inside for the source interface and outside for the destination interface. Click Continue.
9

In section 3, Packets, make these changes:

  • Expand the Original Address menu, click Choose, and select the Site-to-Site-PC-Pool object you created in the prerequisites section.

  • Expand the Translated Address menu, click Choose, and select the Site-to-Site-PC-Pool object you created in the prerequisites section.

10

Skip section 4, Advanced.
11

For an FDM-managed device, in section 5, Name, give the NAT rule a name.
12

Click Save.
13

For an ASA, create a crypto map. See CLI Book 3: Cisco ASA Series VPN CLI Configuration Guide and review the chapter on LAN-to-LAN IPsec VPNs for more information on creating a crypto map.
14

Review and deploy now the changes you made, or wait and deploy multiple changes at once.

Previous topic Prevent a Range of IP Addresses from Being Translated When Traversing the Outside Interface Next topic Manage Tenants and Users