ubject of NAT on an ASA could fill a book itself. My goal is to keep it simple. If you need more information than what I've provided here, the Cisco command references are a good place to start. The commands you're most likely to need are: The nat command is used when you're translating addresses from a more secure interface to a less secure one. For example, if you need to translate an address on the inside of your ASA to an address on the outside, use the nat command. Private IP addresses on the inside of an ASA are translated to one or more public IP ad- dresses with the nat command. Technically, the addresses do not need to be private and public addresses, as described by RFC1918. The ASA documentation uses the terms "global" and "local" to describe addresses outside the ASA as opposed to those inside. static The static command is used when you're translating addresses from a less secure interface to a more secure one. For example, if you have a server inside your ASA that needs to be accessed from outside, assign a public IP address to the private IP address of the server using the static command. global The global command is used for PAT configurations where many addresses are translated to one address. It is also used to provide a pool of NAT addresses. This command is used in conjunction with the nat command. NAT Examples There are many possible NAT scenarios, some of which can become quite complicated. I will cover some of the more common scenarios here. For these examples, I will be using 10.0.0.0 to represent a publicly routable IP network, and 192.168.1.0 as a private, unroutable network. Simple PAT using the outside interface One of the most common uses for a firewall is providing an office with protection from the Internet. Assuming all nodes inside the firewall require access to the Internet and no connections will be initiated inbound, a simple PAT configuration can be used. Here, I've configured the outside interface to be used as the IP address for the global PAT. In other words, all packets tha