Internet working without nat

InTheJuniverse — Tue, 12 Oct 2021 15:01:25 GMT

We are on Cisco ASA 5516.

There is an interface 10.50.70.0/23 on the firewall and it has outbound access list set to 'permit any'. But there is no NAT configured for this interface.

Yet, systems behind this interface are able to access internet, how is that possible? I thought NAT was mandatory.

Packet tracer:

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
Found next-hop X.X.X.X (gateway) using egress ifc outside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
(Access list permit ip any any snipped)
Additional Information:

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: SFR
Subtype:
Result: ALLOW
Config:
class-map sfr
match access-list sfr_redirect
policy-map global_policy
class sfr
sfr fail-open
service-policy global_policy global
Additional Information:

Phase: 7
Type: FOVER
Subtype: standby-update
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 386155607, packet dispatched to next module

Result:
input-interface: XXXXX
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

Re: Internet working without nat

Marvin Rhoads — Tue, 12 Oct 2021 16:05:14 GMT

NAT isn't required on the ASA per se.

There could be an upstream device performing NAT for the clients behind the ASA.

Re: Internet working without nat

InTheJuniverse — Tue, 12 Oct 2021 16:21:51 GMT

Our ASA is the only device that does all the NAT.

Re: Internet working without nat

Marvin Rhoads — Tue, 12 Oct 2021 16:32:31 GMT

What does traceroute show you?

Re: Internet working without nat

InTheJuniverse — Wed, 13 Oct 2021 08:53:53 GMT

I jumped the gun!

I looked at the asdm logs and assumed the packets are going through. ACL allowed everything, hence the logs, but on the end host interent access didn't work.

Thank you again!

topic Re: Internet working without nat in Network Security

Internet working without nat

Re: Internet working without nat

Re: Internet working without nat

Re: Internet working without nat

Re: Internet working without nat