NAT Control
NAT control requires that packets traversing from an inside interface to an outside interface match a NAT rule; for any host on the inside network to access a host on the outside network, you must configure NAT to translate the inside host address (see Figure 17-2).
Figure 17-2 NAT Control and Outbound Traffic
Security
Figure 17-2 NAT Control and Outbound Traffic
Security
Interfaces at the same security level are not required to use NAT to communicate. However, if you configure dynamic NAT or PAT on a same security interface, then all traffic from the interface to a same security interface or an outside interface must match a NAT rule (see Figure 17-3).
Figure 17-3 NAT Control and Same Security Traffic
Security Security
Figure 17-3 NAT Control and Same Security Traffic
Security Security
- Outside
Similarly, if you enable outside dynamic NAT or PAT, then all outside traffic must match a NAT rule when it accesses an inside interface (see Figure 17-4).
Figure 17-4 NAT Control and Inbound Traffic
Security Security
Figure 17-4 NAT Control and Inbound Traffic
Security Security
Static NAT does not cause these restrictions.
By default, NAT control is disabled, so you do not need to perform NAT on any networks unless you choose to perform NAT. If you upgraded from an earlier version of software, however, NAT control might be enabled on your system. Even with NAT control disabled, you need to perform NAT on any addresses for which you configure dynamic NAT. See the "Dynamic NAT and PAT Implementation" section on page 17-16 for more information on how dynamic NAT is applied.
If you want the added security of NAT control but do not want to translate inside addresses in some cases, you can apply a NAT exemption or identity NAT rule on those addresses. (See the "Bypassing NAT" section on page 17-28 for more information).
To configure NAT control, see the "Configuring NAT Control" section on page 17-15.
In multiple context mode, the packet classifier might rely on the NAT configuration to assign packets to contexts if you do not enable unique MAC addresses for shared interfaces. See the "How the Security Appliance Classifies Packets" section on page 3-3 for more information about the relationship between the classifier and NAT.
Note
Continue reading here: Dynamic NAT and PAT Implementation
Was this article helpful?