Transparent Mode Routing Requirements For Remote Networks; Determining The Egress Interface - Cisco ASA Series Configuration Manual

Routing NAT Packets
Figure 10-11
Server

Transparent Mode Routing Requirements for Remote Networks

When you use NAT in transparent mode, some types of traffic require static routes. See the general
operations configuration guide for more information.

Determining the Egress Interface

When the ASA receives traffic for a mapped address, the ASA untranslates the destination address
according to the NAT rule, and then it sends the packet on to the real address. The ASA determines the
egress interface for the packet in the following ways:
•
•
The following figure shows the egress interface selection method in routed mode. In almost all cases, a
route lookup is equivalent to the NAT rule interface, but in some configurations, the two methods might
differ.
Cisco ASA Series Firewall CLI Configuration Guide
10-14
Proxy ARP and Virtual Telnet
Virtual Telnet:
209.165.200.230
Inside
Identity NAT for
209.165.200.230
between inside and outside
with Proxy ARP
Transparent mode—The ASA determines the egress interface for the real address by using the NAT
rule; you must specify the source and destination interfaces as part of the NAT rule.
Routed mode—The ASA determines the egress interface in one of the following ways:
You configure the interface in the NAT rule—The ASA uses the NAT rule to determine the
–
egress interface. However, you have the option to always use a route lookup instead. In certain
scenarios, a route lookup override is required; for example, see
Access, page 10-19.
You do not configure the interface in the NAT rule—The ASA uses a route lookup to determine
–
the egress interface.
209.165.201.11
Outside
Telnet to 209.165.200.230.
Authenticate.
Communicate with server.
Chapter 10 NAT Examples and Reference
1
2
3
NAT and VPN Management