topic Re: ASA NAT question in Network Security

ASA NAT question

meidanmeshulam — Wed, 31 Mar 2021 17:30:37 GMT

Hi everyone,

Here's my question, given the next NAT rule:
nat (any,DMZ) source static any any destination static nat_12.164.193.111 vip_172.24.56.77 unidirectional description abcd ,
Does the Cisco ASA uses the outgoing interface as a matching criteria for that NAT rule ?
If so, how can the ASA know, what is the exit interface ??? Nat is prior to Egress interface as far as I know.

Thanks a lot !

Re: ASA NAT question

Francesco Molino — Thu, 01 Apr 2021 04:01:08 GMT

In terms of order of operations, traffic from inside to outside (from your other zones to this dmz zone), routing comes right before nat and this how it knows where the next hop is.

Re: ASA NAT question

meidanmeshulam — Thu, 01 Apr 2021 13:52:17 GMT

Thanks for your replay,

So in my case the traffic is actually coming from the outside (Internet int) to the DMZ and not vice versa.
regardless, are you sure that routing comes before NAT ? can you back it up ?

Thank you !

Re: ASA NAT question

Francesco Molino — Sat, 03 Apr 2021 02:16:14 GMT

I’m re-reading my post and I replied wrong for ASA. My reply stands for routers for inside to outside.

On ASA, however, nat comes before l3 route module; it uses the interface you configure.