, however. The order of interfaces and networks can be confusing. If you look carefully at the preceding example, you'll see that the references are essentially: (inside-int,outside-int) outside-net inside-net Remember that these static statements are allowing connections from outside to come into these two IP addresses, which reside inside the secure network. This may sound dangerous, but because the outside interface has a security level of 0 and the inside interface has a security level of 100, traffic cannot flow from outside to inside unless it's permitted with an access list. In other words, you must now create an access list to allow the desired traffic to pass. Port redirection Port redirection is different from PAT. While PAT translates a pool of addresses to a single address by translating the ports within the packets being sent, port redirection does something else entirely. Port redirection allows you to configure a static NAT where, though there is one IP address on the public side, there can be many IP addresses on the private side, each of which responds to a different port. PAT does not permit inbound connections. Port translation does. Imagine we have only eight IP addresses on our public network, which are all in use: .0 - Network address .1 - ISP Router VIP (HSRP) .2 - ISP Router 1 .3 - ISP Router 2 .4 - Primary ASA .5 - Secondary ASA .6 - Web server public IP .7 - Broadcast address While it might not seem realistic to have SO much resilient equipment on such a small network, you might be surprised by what happens in the field. Many small-business networks are limited to eight addresses. In reality, many don't need any more than that. In this example, we need to have only one static NAT configured-the web server. Here is the configuration relating to NAT: global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.000 static (inside,outside) 10.0.0.6 192.168.1.6 netmask 255.255.255.255 0 This configuration works fine, but what if we need another web server to be available on the Internet? Say a s