Bypassing Nat When Nat Control Is Enabled - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 17 Applying NAT

Bypassing NAT when NAT Control is Enabled

If you enable NAT control, then inside hosts must match a NAT rule when accessing outside hosts. If
you do not want to perform NAT for some hosts, then you can bypass NAT for those hosts (alternatively,
you can disable NAT control). You might want to bypass NAT, for example, if you are using an
application that does not support NAT (see the
on page 25-2
You can configure traffic to bypass NAT using one of three methods. All methods achieve compatibility
with inspection engines. However, each method offers slightly different capabilities, as follows:
•
•
•
Policy NAT
Policy NAT lets you identify real addresses for address translation by specifying the source and
destination addresses in an extended access list. You can also optionally specify the source and
destination ports. Regular NAT can only consider the real addresses. For example, you can use translate
the real address to mapped address A when it accesses server A, but translate the real address to mapped
address B when it accesses server B.
When you specify the ports in policy NAT for applications that require application inspection for
secondary channels (FTP, VoIP, etc.), the security appliance automatically translates the secondary ports.
All types of NAT support policy NAT except for NAT exemption. NAT exemption uses an access list to
Note
identify the real addresses, but differs from policy NAT in that the ports are not considered. See the
"Bypassing NAT" section on page 17-28
NAT exemption using static identity NAT, which does support policy NAT.
OL-10088-01
for information about inspection engines that do not support NAT).
Identity NAT (nat 0 command)—When you configure identity NAT (which is similar to dynamic
NAT), you do not limit translation for a host on specific interfaces; you must use identity NAT for
connections through all interfaces. Therefore, you cannot choose to perform normal translation on
real addresses when you access interface A, but use identity NAT when accessing interface B.
Regular dynamic NAT, on the other hand, lets you specify a particular interface on which to translate
the addresses. Make sure that the real addresses for which you use identity NAT are routable on all
networks that are available according to your access lists.
For identity NAT, even though the mapped address is the same as the real address, you cannot initiate
a connection from the outside to the inside (even if the interface access list allows it). Use static
identity NAT or NAT exemption for this functionality.
Static identity NAT (static command)—Static identity NAT lets you specify the interface on which
you want to allow the real addresses to appear, so you can use identity NAT when you access
interface A, and use regular translation when you access interface B. Static identity NAT also lets
you use policy NAT, which identifies the real and destination addresses when determining the real
addresses to translate (see the
NAT). For example, you can use static identity NAT for an inside address when it accesses the
outside interface and the destination is server A, but use a normal translation when accessing the
outside server B.
NAT exemption (nat 0 access-list command)—NAT exemption allows both translated and remote
hosts to initiate connections. Like identity NAT, you do not limit translation for a host on specific
interfaces; you must use NAT exemption for connections through all interfaces. However,
NAT exemption does let you specify the real and destination addresses when determining the real
addresses to translate (similar to policy NAT), so you have greater control using NAT exemption.
However unlike policy NAT, NAT exemption does not consider the ports in the access list.
"When to Use Application Protocol Inspection" section
"Policy NAT" section on page 17-9
for other differences. You can accomplish the same result as
Cisco Security Appliance Command Line Configuration Guide
NAT Overview
for more information about policy
17-9