T Techclick ← All lessons
Cisco Secure Firewall · FTD / FMC · Interactive lesson

Cisco FTD NAT — Auto vs Manual, twice NAT, prove it

The tunnel is up. Internet works. Partner subnet 10.1.1.0/24 is dark. packet-tracer already shows the inside host being PAT’d to the outside interface. This lesson is the table LINA actually walks: Auto NAT versus Manual (twice) NAT, Section 1 before-auto versus Section 3 after-auto, and the two tracer runs that name the winning rule.

~18 min read · L2 primary · Quiz at end · Dummy lab only

After this page you can

Quick answer

NAT on Threat Defense lives in LINA, not Snort. Cisco stores Auto NAT and Manual NAT in one table with three sections. Section 1 is Manual NAT before Auto (default; first-match, you order it). Section 2 is Auto NAT (object NAT; LINA sorts it: static, then smallest real, then lowest IP, then object name). Section 3 is Manual NAT after Auto (general leftovers). First match wins — if Section 1 hits, 2 and 3 never run. Use Auto NAT unless you need a source+destination pair (twice NAT). Prove it with packet-tracer: read the Type: NAT / UN-NAT Config: line, then show nat.

Say this out loud

Auto NAT is one object, unpaired. Manual NAT is one rule that can lock source and destination together. Section 1 beats Auto. I do not trust the policy until packet-tracer prints the Config line.

1. Why the PAT rule ate the VPN

The ticket is always the same shape. Site-to-site is up. SaaS is fine. The partner prefix never encrypts. Someone already added “more NAT.” The PAT rule is doing its job — and that is the bug.

Cisco’s NAT table is not “the order you typed in FMC.” It is three sections, first match, stop. A broad Auto PAT in Section 2 will translate VPN-interesting traffic unless a more specific Manual identity rule sits in Section 1 and matches both the inside prefix and the remote prefix.

Hero · one box, one translation
Inside host traffic passing Threat Defense NAT toward the internet
Notice: the host never picks Auto or Manual. LINA walks Section 1 → 2 → 3 and stops at the first match.

Real

The address on the host before translation. Access Control matches this, not the public mapped IP.

Mapped

What the other side sees. Interface PAT, a pool, or a 1:1 static. Device interface IPs themselves are not translated.

Auto NAT

NAT is a parameter of a network object (not a group). Source and dest can each hit a separate rule. LINA orders Section 2 for you.

Manual / twice NAT

One rule can name source and destination. Packet matches that rule only. You place it before Auto (Section 1) or after Auto (Section 3).

Dummy lab on this page

Inside 10.10.8.0/24, host 10.10.8.22, outside PAT 203.0.113.20, internet dest 198.51.100.80:443, VPN remote 10.1.1.0/24, published web 10.10.8.80 → 203.0.113.80. Confirm live syntax before you type on a real device.

2. Mental model: Auto, Manual, three sections

Pre-train the hard words before the runbook. Interviews fail on the synonyms, not the click path.

Flow 1 · the table LINA walks
Packet in → Section 1 → Section 2 → Section 3 → first match wins Ingress inside · 10.10.8.22 Section 1 Manual · before Auto Section 2 Auto NAT · LINA sorts Section 3 Manual · after Auto Auto NAT · object NAT NAT is a parameter of one network object Source and dest can hit two separate rules Cannot pair sourceA/destA vs sourceA/destB One Auto NAT rule per object (not a group) Lands in Section 2 · auto-ordered Cisco: prefer Auto unless you need Manual extras VoIP often safer on Auto (unpaired objects) Manual NAT · twice NAT One rule can name source and destination Packet matches that rule only — walk stops Dest mapping, if present, is always static You place it before Auto or after Auto Section 1 default · or after-auto → 3 Use for VPN exempt, dest-aware PAT, hairpin Specific rules above general rules in the section

Read left → right, then the two cards. Cisco: if a match is found in Section 1, Sections 2 and 3 are not evaluated. Section 0 (system) sits above all of this.

Do not treat Auto as “source-only forever”

Auto NAT checks both source and destination of the packet against Auto rules. Two different Auto rules can translate source and dest independently. What Auto cannot do is pair them: you cannot say “when this source talks to dest A, translate one way; when it talks to dest B, translate another.” That pairing is Manual / twice NAT.

3. Decision flow before you add a rule

Draw this before you open Devices → NAT. Destination-aware means Manual. “Must beat PAT” means Section 1. “Must lose to a more specific Auto static” means Section 3.

Path · specific versus general
Decision diamond splitting a specific NAT path from a general NAT path
Path A is the dest-aware exempt (Section 1). Path B is the leftover PAT. The diamond is “does this flow need a source+destination pair?”
Flow 2 · pick the section before you click Add Rule
Need a new NAT? Source+dest pair? A/B vs A/C different? NO Auto NAT Section 2 YES Must beat Auto PAT? VPN exempt / static dest Manual after Section 3 Manual before Auto Section 1 · identity / dest-aware Prove: two packet-tracer runs Internet dest → PAT Config · VPN dest → identity Config

Read top → bottom. Diamond = decision. Left exits are “do not put this in Section 1.” Bottom box is the only close for the ticket.

4. How to choose Auto vs Manual

Cisco’s own recommendation: use Auto NAT unless you need the extra features Manual NAT provides. If X then Y. Do not invent a third type.

You needChooseInsert
Whole inside subnet shares the outside interfaceDynamic PAT (interface) — Auto is enoughSection 2 Auto NAT
Published server, fixed public IP, both directionsStatic NAT — Auto is enoughSection 2 Auto NAT (LINA puts static before dynamic)
Same inside hosts: PAT to internet, identity to VPN peerManual identity (source=inside, dest=peer, both → themselves)Section 1, above any general PAT
sourceA/destA translates differently than sourceA/destBManual / twice NAT (dest-aware)Section 1 if it must beat Auto
General PAT pool that must not steal a more specific Auto staticManual dynamic PAT / PAT poolSection 3 after-auto
Same-interface U-turn (inside user hits the public mapped IP)Manual NAT (dest un-translate + same ifc)Section 1; enable same-interface / hairpin as the topology needs
Second NAT for an IP that already has Auto NATNew network object, same IP, different name — or switch to ManualAuto allows only one NAT per object
Dual-ISP Manual NAT (primary + backup)Manual, no destination criteria; primary rule above backupCisco: dest objects pin the rule to the primary ifc
TypeWhat it doesWho can start
Dynamic NATReal group → mapped pool, first comeReal host (return follows xlate)
Dynamic PATMany reals → one mapped IP + unique portReal host. Interface PAT is the usual branch design
Static NATFixed 1:1, bidirectionalEither side (ACP still required)
Identity NATReal → itself (exempt / bypass translate)Used to punch a hole in a broader PAT

5. Runbook Side A → B → C

Goal: objects and zones first, then the two NAT rules in the right sections, then two tracers that print different Config: lines.

Side A — Objects and interface objects

Primary source: Cisco “Configure and Verify NAT on FTD” (Document ID 212702) — FTD NAT uses Security Zones or Interface Groups, not classic ASA nameif in the GUI.

  1. Zones before rules

    Objects → Object Management → Interface. Lab: zone inside holds the inside iface, zone outside holds the outside iface. An iface is in one Security Zone; it can sit in multiple Interface Groups.

  2. Network objects

    Create host/network objects you will reuse: Net_10.10.8.0_24, Host_10.10.8.22, net_10.1.1.0_24, web-real 10.10.8.80, web-mapped 203.0.113.80. Do not name an object pat-pool.

Side B — NAT policy: Auto PAT, then Manual exempt

Primary source: FMC path in Document ID 212702 — Devices → NAT → New Policy → Threat Defense NAT, assign the FTD, Add Rule. FDM equivalent is Policies → NAT.

  1. Auto NAT · dynamic PAT (Section 2)

    NAT Rule = Auto NAT Rule. Type = Dynamic. Insert = Auto NAT Rules (Section 2). Source interface inside, Destination outside. Original Source = Net_10.10.8.0_24. Translated Source = Destination Interface IP (interface PAT). Optional Advanced: Fallthrough to Interface PAT if you used a pool first.

  2. Manual NAT · identity exempt (Section 1)

    NAT Rule = Manual NAT Rule. Type = Static. Insert = In Section 1 (before Auto). Original Source and Translated Source = Net_10.10.8.0_24. Original Destination and Translated Destination = net_10.1.1.0_24. Advanced: for identity NAT, enable Perform Route Lookup when you must not pin egress to the mapped interface.

  3. Optional leftovers in Section 3

    A PAT pool that should only catch traffic Auto missed: Manual NAT, Type Dynamic, Insert In Section 3. CLI will show after-auto and pat-pool. Specific rules still go above general rules inside that section.

  4. Deploy, then ACP on real IPs

    Static NAT is bidirectional. ACP still uses the real address (Cisco: same as ASA). Permit 10.10.8.80, not 203.0.113.80.

https://fmc.lab.example.com/#devices/nat/LAB-FTD-NAT/add-auto
Training mock · not live

Devices → NAT → LAB-FTD-NAT → Add Rule

Add Rule · inside-pat-outside

Interface ObjectsTranslationPAT PoolAdvanced
Auto NAT Rule
Dynamic
Auto NAT Rules (Section 2)
Yes
inside
outside
Net_10.10.8.0_24
Destination Interface IP

Exact fields: NAT Rule (Auto NAT Rule), Type (Dynamic), Insert (Auto NAT Rules), Source/Destination Interface Objects, Original Source, Translated Source = Destination Interface IP. Path from Cisco TAC 212702. Lab values only.

https://fmc.lab.example.com/#devices/nat/LAB-FTD-NAT/add-manual
Training mock · not live

Devices → NAT → LAB-FTD-NAT → Add Rule

Add Rule · vpn-exempt-partner

Interface ObjectsTranslationPAT PoolAdvanced
Manual NAT Rule
Static
In Section 1 (before Auto NAT)
inside → outside
Net_10.10.8.0_24
Net_10.10.8.0_24
net_10.1.1.0_24
net_10.1.1.0_24
Perform Route Lookup · enabled for this identity rule

Exact fields: NAT Rule (Manual NAT Rule), Type (Static), Insert (In Section 1), Original/Translated Source identical, Original/Translated Destination identical. Dest mapping is always static. Path from Cisco TAC 212702 Task 3. Lab values only.

Side C — Prove with packet-tracer

Primary source: Document ID 212702 Verify tasks, plus “Use Firepower Threat Defense Captures and Packet Tracer” (212474). Tracer is a predicted packet. Run it twice when a VPN SA must come up.

  1. Internet dest must hit PAT

    packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443. You want Type: NAT with Config showing source dynamic Net_10.10.8.0_24 interface (or the Auto object form). Final Action: allow.

  2. VPN dest must hit the exempt

    packet-tracer input inside tcp 10.10.8.22 51922 10.1.1.10 443. You want UN-NAT / NAT Config showing the identity twice NAT, Additional Information Static translate 10.10.8.22/… to 10.10.8.22/…. If you still see interface PAT, Section 1 did not match — dest object, zone pair, or insert is wrong.

  3. Live counters

    show nat — Manual Policies (Section 1) vs Auto (Section 2) vs Manual (Section 3), translate_hits / untranslate_hits. show xlate flags: s static, T twice, I identity, i dynamic, r portmap. show run nat should show the exempt without after-auto, and any Section 3 rule with after-auto.

Dummy lab · two tracers · different Config lines
> packet-tracer input inside tcp 10.10.8.22 51922 198.51.100.80 443
Phase: 6
Type: NAT
Config:
nat (inside,outside) source dynamic Net_10.10.8.0_24 interface
Additional Information:
Dynamic translate 10.10.8.22/51922 to 203.0.113.20/18422
Result: Action: allow

> packet-tracer input inside tcp 10.10.8.22 51922 10.1.1.10 443
Phase: 3
Type: UN-NAT
Subtype: static
Config:
nat (inside,outside) source static Net_10.10.8.0_24 Net_10.10.8.0_24 destination static net_10.1.1.0_24 net_10.1.1.0_24
Additional Information:
Untranslate 10.1.1.10/443 to 10.1.1.10/443
Phase: 6
Type: NAT
Additional Information:
Static translate 10.10.8.22/51922 to 10.10.8.22/51922
Result: Action: allow
Green success

Internet tracer prints dynamic interface PAT. VPN tracer prints the identity twice-NAT Config and does not print the PAT line. show nat Section 1 exempt hits climb on the partner flow. FMC Devices → Troubleshoot → Packet Tracer is the same utility if you are not on CLI.

6. Runtime path of one packet

After Deploy the user does not care about your insert dropdown. The live packet does this.

Journey · match then translate
Four glass panels showing match, translate, forward, un-NAT
Match the section, write the xlate, forward on the mapped side, un-NAT the reply. UN-NAT on inbound static happens before ACP so policy still sees the real host.
  1. SYN hits inside. LINA (not Snort) owns NAT.
  2. Existing xlate? Reuse it. Else walk Section 0 → 1 → 2 → 3. Stop at first match.
  3. If dest is 10.1.1.10, Section 1 identity twice NAT matches. Source stays 10.10.8.22. VPN can encrypt the real prefix.
  4. If dest is 198.51.100.80, Section 1 misses. Section 2 Auto PAT writes 10.10.8.22:51922 → 203.0.113.20:18422.
  5. Access Control is evaluated against real addresses. Permit the inside host / inside server, not the PAT IP.
  6. Inbound to a static mapped address: UN-NAT first, then ACP sees dest 10.10.8.80.
  7. Snort may still inspect after LINA allows. NAT success is not an IPS pass.
  8. Reply uses the xlate. show xlate / show conn are live; tracer was predicted.
Dummy lab · show nat after both flows
> show nat
Manual NAT Policies (Section 1)
1 (inside) to (outside) source static Net_10.10.8.0_24 Net_10.10.8.0_24
    destination static net_10.1.1.0_24 net_10.1.1.0_24
    translate_hits = 9, untranslate_hits = 9

Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic Net_10.10.8.0_24 interface
    translate_hits = 98, untranslate_hits = 138

Manual NAT Policies (Section 3)
1 (inside) to (dmz) source dynamic Net_10.10.8.0_24 pat-pool range-web flat include-reserve
    translate_hits = 0, untranslate_hits = 0

7. Traps and proof checklist

Ops · prove, do not guess
Operations desk with a monitor showing health checks after a NAT verification
Close the ticket only when two tracers print two different Config lines and show nat hits move on the rule you named.
SymptomLikely causeProof
VPN up, no interesting trafficBroad PAT matched in Section 2; no Section 1 identity pairTracer to peer dest shows source dynamic … interface
Exempt rule “is there” but PAT still winsInserted in Section 3, or dest object missing, or zones wrongshow run nat — if you see after-auto on the exempt, it is Section 3
ACP drop on a published serverRule written for mapped IP 203.0.113.80Inbound trace: UN-NAT then ACL dest = real 10.10.8.80
New NAT ignored on existing sessionsOld xlate / conn still pinnedclear xlate (drops translated conns) or clear conn for that flow
Second Auto NAT for the same object refusedOne Auto NAT per objectClone the object (new name, same IP) or use Manual
Hosts on the mapped LAN lose ARPBroad identity NAT, proxy ARP still onDisable proxy ARP on that identity rule; proxy ARP is decided on the “source” address
Services on the FTD outside IP die after static NATTranslated Source = interface IP on a staticCisco warning: all traffic to that interface IP is redirected
Dual-ISP Manual NAT always uses primaryDestination objects in the ruleRemove dest criteria; keep primary rule above backup
Pilot checklist

Knowledge check

Six judgment items. Map each miss back to the section named in the reason.

Q1

Tunnel is up. Tracer from 10.10.8.22 to 10.1.1.10 shows source dynamic Net_10.10.8.0_24 interface. What is the first correct fix?

Correct: b. PAT in Section 2 is doing its job. VPN-interesting traffic needs a dest-aware identity rule that matches first in Section 1. Re-read Why + Runbook Side B.
Q2

Why can Auto NAT not enforce “when A talks to B, PAT; when A talks to C, identity”?

Correct: c. Cisco: Auto source and dest can each hit a separate rule, but those rules cannot be tied to a source/destination combination. That pairing is Manual / twice NAT. Re-read Mental model.
Q3

What is the evaluation order of the NAT table you configure?

Correct: a. Cisco NAT rule order: 1 then 2 then 3 until a match. A Section 1 hit skips Auto entirely. (Section 0 system rules sit above this table.) Re-read Decision flow.
Q4

Section 2 has a /32 static object and a /24 dynamic PAT object. Which is assessed first?

Correct: d. Auto NAT order is static then dynamic; within a type, fewest real IPs first, then lowest IP, then object name. Re-read Mental model / How to choose.
Q5

After the exempt is in Section 1, which pair of tracer results is the close?

Correct: b. Two dests, two Config lines. Allow without reading NAT Config is how the original ticket stayed open. Re-read Side C + Runtime.
Q6

You publish 10.10.8.80 as 203.0.113.80 with static NAT. The inbound ACP Allow must match which destination?

Correct: c. Cisco: ACP uses real IPs. Inbound static UN-NAT runs first, then the ACL sees dest 10.10.8.80. Re-read Traps.

Sources

Related: FTD VPN (NAT-exempt on the tunnel) · Session factory · LINA then Snort · Access Control · real IPs · FTD & FMC fundamentals · Cisco Secure Firewall hub