Bypassing Nat When Nat Control Is Enabled; Policy Nat - Cisco 7604 Configuration Manual

NAT Overview

Bypassing NAT when NAT Control is Enabled

If you enable NAT control, then inside hosts must match a NAT rule when accessing outside hosts. If
you do not want to perform NAT for some hosts, then you can bypass NAT for those hosts (alternatively,
you can disable NAT control). You might want to bypass NAT, for example, if you are using an
application that does not support NAT. (See the
information about inspection engines that do not support NAT.)
You can configure traffic to bypass NAT using one of three methods. All methods achieve compatibility
with inspection engines. However, each method offers slightly different capabilities, as follows:
•
•
•

Policy NAT

Policy NAT lets you identify real addresses for address translation by specifying the source and
destination addresses in an extended access list. You can also optionally specify the source and
destination ports. Regular NAT can only consider the source addresses, and not the destination. For
example, with policy NAT, you can translate the real address to mapped address A when it accesses
server A, but translate the real address to mapped address B when it accesses server B.
For applications that require application inspection for secondary channels (FTP, VoIP, and so on), the
policy specified in the policy NAT statement should include the secondary ports. Or, when the ports
cannot be predicted, the policy should specify only the IP addresses for the secondary channel. This way,
the FWSM translates the secondary ports.
Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM
16-10
Identity NAT (nat 0 command)—When you configure identity NAT (which is similar to dynamic
NAT), you do not limit translation for a host on specific interfaces; you must use identity NAT for
connections through all interfaces. Therefore, you cannot choose to perform normal translation on
real addresses when you access interface A, but use identity NAT when accessing interface B.
Regular dynamic NAT, on the other hand, lets you specify a particular interface on which to translate
the addresses. Make sure that the real addresses for which you use identity NAT are routable on all
networks that are available according to your access lists.
For identity NAT, even though the mapped address is the same as the real address, you cannot initiate
a connection from the outside to the inside (even if the interface access list allows it). Use static
identity NAT or NAT exemption for this functionality.
Static identity NAT (static command)—Static identity NAT lets you specify the interface on which
you want to allow the real addresses to appear, so you can use identity NAT when you access
interface A, and use regular translation when you access interface B. Static identity NAT also lets
you use policy NAT, which identifies the real and destination addresses when determining the real
addresses to translate. (See the
policy NAT.) For example, you can use static identity NAT for an inside address when it accesses
the outside interface and the destination is server A, but use a normal translation when accessing the
outside server B.
NAT exemption (nat 0 access-list command)—NAT exemption allows both translated and remote
hosts to initiate connections. Like identity NAT, you do not limit translation for a host on specific
interfaces; you must use NAT exemption for connections through all interfaces. However,
NAT exemption does let you specify the real and destination addresses when determining the real
addresses to translate (similar to policy NAT), so you have greater control using NAT exemption.
However unlike policy NAT, NAT exemption does not consider the ports in the access list.
"Inspection Engine Overview" section on page 22-2
"Policy NAT" section on page 16-10
Chapter 16 Configuring NAT
for more information about
OL-20748-01
for