Nat In Transparent Mode - Cisco 7604 Configuration Manual

Chapter 16 Configuring NAT
Figure 16-1
10.1.2.27
See the following commands for this example:
hostname(config)# nat (inside) 1 10.1.2.0 255.255.255.0
hostname(config)# global (outside) 1 209.165.201.1-209.165.201.15

NAT in Transparent Mode

Using NAT in transparent mode eliminates the need for the upstream or downstream routers to perform
NAT for their networks. For example, a transparent firewall FWSM is useful between two VRFs so you
can establish BGP neighbor relations between the VRFs and the global table. However, NAT per VRF
might not be supported. In this case, using NAT in transparent mode is essential.
NAT in transparent mode has the following requirements and limitations:
•
•
•
•
•
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
OL-20748-01
NAT Example: Routed Mode
Originating
Packet
Translation
209.165.201.10
When the mapped addresses are not on the same network as the transparent firewall, then on the
upstream router, you need to add a static route for the mapped addresses that points to the
downstream router (through the FWSM).
If the real destination address is not directly-connected to the FWSM, then you also need to add a
static route on the FWSM for the real destination address that points to the downstream router.
Without NAT, traffic from the upstream router to the downstream router does not need any routes on
the FWSM because it uses the MAC address table. NAT, however, causes the FWSM to use a route
lookup instead of a MAC address lookup, so it needs a static route to the downstream router.
The alias command is not supported.
Because the transparent firewall does not have any interface IP addresses, you cannot use interface
PAT.
ARP inspection is not supported. Moreover, if for some reason a host on one side of the firewall
sends an ARP request to a host on the other side of the firewall, and the initiating host real address
is mapped to a different address on the same subnet, then the real address remains visible in the ARP
request.
Web Server
www.cisco.com
Outside
209.165.201.2
209.165.201.10
10.1.2.1
Inside
10.1.2.27
NAT Overview
Responding
Packet
Undo Translation
10.1.2.27
16-3