Cisco ASA Series Cli Configuration Manual page 757

Chapter 1 Information About NAT
NAT in Routed Mode
Figure 1-9
Figure 1-9
10.1.2.27
1.
2.
3.
NAT in Transparent Mode
Using NAT in transparent mode eliminates the need for the upstream or downstream routers to perform
NAT for their networks.
NAT in transparent mode has the following requirements and limitations:
•
•
•
Figure 1-10
outside interfaces. The transparent firewall in this scenario is performing the NAT service so that the
upstream router does not have to perform NAT.
shows a typical NAT example in routed mode, with a private network on the inside.
NAT Example: Routed Mode
Originating
Packet
Translation
209.165.201.10
When the inside host at 10.1.2.27 sends a packet to a web server, the real source address of the
packet, 10.1.2.27, is changed to a mapped address, 209.165.201.10.
When the server responds, it sends the response to the mapped address, 209.165.201.10, and the
ASA receives the packet because the ASA performs proxy ARP to claim the packet.
The ASA then changes the translation of the mapped address, 209.165.201.10, back to the real
address, 10.1.2.27, before sending it to the host.
Because the transparent firewall does not have any interface IP addresses, you cannot use interface
PAT.
ARP inspection is not supported. Moreover, if for some reason a host on one side of the ASA sends
an ARP request to a host on the other side of the ASA, and the initiating host real address is mapped
to a different address on the same subnet, then the real address remains visible in the ARP request.
Translating between IPv4 and IPv6 networks is not supported. Translating between two IPv6
networks, or between two IPv4 networks is supported.
shows a typical NAT scenario in transparent mode, with the same network on the inside and
Web Server
www.cisco.com
Outside
209.165.201.2
Security
Appliance
209.165.201.10
10.1.2.1
Inside
10.1.2.27
Cisco ASA Series CLI Configuration Guide
NAT in Routed and Transparent Mode
Responding
Packet
Undo Translation
10.1.2.27
1-11