26-14
Cisco ASA 5500 Series Configuration Guide using ASDM
OL-20339-01
Chapter 26 Information About NAT
NAT in Routed and Transparent Mode
• ARP inspection is not supported. Moreover, if for some reason a host on one side of the adaptive
security appliance sends an ARP request to a host on the other side of the adaptive security
appliance, and the initiating host real address is mapped to a different address on the same subnet,
then the real address remains visible in the ARP request.
Figure 26-13 shows a typical NAT scenario in transparent mode, with the same network on the inside
and outside interfaces. The transparent firewall in this scenario is performing the NAT service so that the
upstream router does not have to perform NAT.
Figure 26-13 NAT Example: Transparent Mode
1.
When the inside host at 10.1.1.75 sends a packet to a web server, the real source address of the
packet, 10.1.1.75, is changed to a mapped address, 209.165.201.15.
2. When the server responds, it sends the response to the mapped address, 209.165.201.15, and the
adaptive security appliance receives the packet because the upstream router includes this mapped
network in a static route directed through the adaptive security appliance.
3. The adaptive security appliance then undoes the translation of the mapped address, 209.165.201.15,
back to the real address, 10.1.1.1.75. Because the real address is directly-connected, the adaptive
security appliance sends it directly to the host.
4. For host 192.168.1.2, the same process occurs, except that the adaptive security appliance looks up
the route in its route table and sends the packet to the downstream router at 10.1.1.3 based on the
static route.
Management IP
10.1.1.1
www.example.com
10.1.1.2
Internet
Source Addr Translation
209.165.201.10 192.168.1.2
Source Addr Translation
209.165.201.15 10.1.1.75
Security
appliance
10.1.1.75
10.1.1.3
192.168.1.1
192.168.1.2
Network 2
Static route on router to
209.165.201.0/27 to downstream router
Static route on security appliance for
192.168.1.1/24 to downstream router
250261
To Next Page
Loading...
Need help?
General
