t originate from the inside will be translated to the same IP address as the one used on the outside interface of the ASA: Chapter 28: ASA Firewall Configuration global (outside) 1 interface nat (inside) 1 (0.0.0.00.0.0.00 0 All internal IP addresses will be translated, because the nat statement references 0.0.0.0, which means all addresses. Simple PAT using a dedicated IP address To accomplish PAT without using the interface's IP address, use the same configuration as the previous one, but specify the IP address used for the global PAT in the global command instead of the keyword interface: global (outside) 1 10.0.0.5 nat (inside) 1 0.0.0.0 0.0.0.0 0 0 If you're playing along at home, you'll hopefully have realized that you must remove the previous NAT entries, or you'll receive a Duplicate NAT entry error upon entering this snippet of code. If you're not, read this note again until it makes sense. Simple PAT with public servers on the inside Small installations may have a server inside (not on a DMZ) that must be accessible from the public Internet. While this is usually not a good idea, it is nevertheless a distinct possibility that you'll need to configure such a solution. Smaller companies-and even home networks-often require such configurations because a DMZ is either imprac- tical or impossible. Here, I've designed a global PAT using the outside interface, with all addresses from the inside being translated. Additionally, I've created two static entries. The first for- wards packets sent to the public IP address 10.0.0.10 to the private IP address 192.168.1.10. The second translates 10.0.0.11 to the private IP address 192.168.1.11: global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 0 0 static (inside,outside) 10.0.0.10 192.168.1.10 netmask 255.255.255.255 0 0 static (inside,outside) 10.0.0.11 192.168.1.11 netmask 255.255.255.255 0 0 static statements override the more generic nat statement, SO these commands can be used together in this way without issue. Be wary when configuring static statements