Cisco ASA 5506-X Configuration Manual page 109

Chapter 5 NAT Examples and Reference
Figure 5-9
Source Addr Translation
10.1.1.75
1.
2.
3.
4.
Routing NAT Packets
The ASA needs to be the destination for any packets sent to the mapped address. The ASA also needs to
determine the egress interface for any packets it receives destined for mapped addresses. This section
describes how the ASA handles accepting and delivering packets with NAT.
•
NAT Example: Transparent Mode
209.165.201.15
10.1.1.2
10.1.1.75
When the inside host at 10.1.1.75 sends a packet to a web server, the real source address of the
packet, 10.1.1.75, is changed to a mapped address, 209.165.201.15.
When the server responds, it sends the response to the mapped address, 209.165.201.15, and the
ASA receives the packet because the upstream router includes this mapped network in a static route
directed to the ASA management IP address. See
more information about required routes.
The ASA then undoes the translation of the mapped address, 209.165.201.15, back to the real
address, 10.1.1.1.75. Because the real address is directly-connected, the ASA sends it directly to the
host.
For host 192.168.1.2, the same process occurs, except for returning traffic, the ASA looks up the
route in its routing table and sends the packet to the downstream router at 10.1.1.3 based on the ASA
static route for 192.168.1.0/24. See
page 5-14 for more information about required routes.
Mapped Addresses and Routing, page 5-12
www.example.com
Internet
Static route on router:
209.165.201.0/27 to 10.1.1.1
Static route on ASA:
192.168.1.0/24 to 10.1.1.3
Management IP
10.1.1.1
ASA
10.1.1.3
192.168.1.1
Network 2
192.168.1.2
Mapped Addresses and Routing, page 5-12
Transparent Mode Routing Requirements for Remote Networks,
Cisco ASA Series Firewall CLI Configuration Guide
Routing NAT Packets
Source Addr Translation
192.168.1.2 209.165.201.10
for
5-11