So lets say we have the following configuration:
=============================================
Interface Gigabitethernet0/1
nameif inside
security-level 100
speed 1000
duplex full
ip address 192.168.1.1 255.255.255.0
Interface Gigabitethernet0/2
nameif dmz
security-level 50
speed 1000
duplex full
ip address 172.16.1.1 255.255.255.0
nat-control
access-group 100 in interface inside
access-group 99 in interface dmz
access-list 100 permit ip any any
access-list 99 permit ip any any
=============================================
So lets say we want to allow communication from the inside segment to the DMZ segment using private addresses.
There are a couple of ways we can achieve this
1.) NAT Exemption via NAT 0
access-list nonat permit ip 192.168.1.0 255.255.255.0 172.16.1.0 255.255.255.0
nat (inside) 0 access-list nonat
2.) Identity NAT via static statements
static (inside,dmz) 192.168.1.0 192.168.1.0 netmask 255.255.255.0
Both scenarios allow communication from the inside segment to the dmz segment while preserving the 192.168.1.X/24 source addresses using 172.16.1.X/24 addresses as the destination.
With scenario 1, I must first initiate traffic from the inside segment (192.168.1.X address) to the DMZ segment (172.16.1.X) before hosts on the dmz segment can initiate traffic to the inside segment.
With scenario 2, I can initiate traffic from either segment regardless of who first initiated a connection.
Now, I know that the identity NAT via the static statement adds an entry in the xlate table which is why either segment can initiate traffic at any time.
My question is, what mechanism controls the communication process when using NAT exemption? That is, what prevents me from initiating traffic FROM the dmz to the inside segment until I've first initiated traffic from the inside to the dmz?
