topic FWSM : Can same security level command create identity nat? in Network Security

FWSM : Can same security level command create identity nat?

phatrachit — Mon, 11 Mar 2019 23:42:43 GMT

Hi All,

As the topic : Can same security level command create identity nat? I found identity nat when show xlate debug command although no configuration related to identitiy nat for those subnet ip address.

My brief configuration

- same security level intra interface is enable

- xlate-baypass is enable

- NAT examption for some subnet

FWSM : Can same security level command create identity nat?

rleivaoc — Wed, 15 Aug 2012 22:02:13 GMT

To my knowlege the FWSM creates a xlate for all connections.

http://www.cisco.com/en/US/docs/security/fwsm/fwsm31/configuration/guide/cfgnat_f.html

"Even if you do not configure NAT, the FWSM continues to create translation sessions for all traffic automatically. In this case, the translation is from the real address to the same real address. See the

show xlate command to view translation sessions."

FWSM : Can same security level command create identity nat?

phatrachit — Thu, 16 Aug 2012 01:15:46 GMT

Hi rleivaoc,

It's true that FWSM will create a xlate for all connections but it wouldn't show up anymore if xlate-bypass enabled. I mean traffic that pass through FWSM because FWSM NAT on Hardware not Software like ASA.