Cisco Systems Transparent Mode Routing Requirements for Remote Networks, Determining the Egress Interface

3-24
Cisco ASA Series Firewall ASDM Configuration Guide
Chapter3 Information About NAT (ASA 8.3 and Later)
Routing NAT Packets
Figure3-19 Proxy ARP and Virtual Telnet
Transparent Mode Routing Requirements for Remote Networks
When you use NAT in transparent mode,some types of traffic require static routes. See the “MAC
Address vs. Route Lookups” section on page6-6 for more information.
Determining the Egress Interface
When the ASA receives traffic for a mapped address, the ASA unstranslates the destination address
according to the NAT rule, and then it sends the packet on to the real address. The ASA determines the
egress interface for the packet in the following ways:
•Transparent mode—The ASA determines the egress interface for the real address by using the NAT
rule; you must specify the source and destination interfaces as part of the NAT rule.
•Routed mode—The ASA determines the egress interface in one of the following ways:
– You configure the interface in the NAT rule—The ASA uses the NAT rule to determine the
egress interface. (8.3(1) through 8.4(1)) The only exception is for identity NAT, which always
uses a route lookup, regardless of the NAT configuration. (8.4(2) and later) For identity NAT,
the default behavior is to use the NAT configuration. However, you have the option to always
use a route lookup instead. In certain scenarios, a route lookup override is required; for example,
see the “NAT and VPN Management Access” section on page3-29.
– You do not configure the interface in the NAT rule—The ASA uses a route lookup to determine
the egress interface.
Figure 3-20 shows the egress interface selection method in routed mode. In almost all cases, a route
lookup is equivalent to the NAT rule interface, but in some configurations, the two methods might differ.
209.165.201.11
Virtual Telnet:
209.165.200.230
Identity NAT for
209.165.200.230
between inside and outside
with Proxy ARP
Outside
Inside
Server
1
2
3
Telnet to 209.165.200.230.
Communicate with server.
Authenticate.