NAT exemption-VPN

[sharath413]

Hi all,

I am studying for CCNA security and came across VPNs and unable to find answers to these question on internet.

1.Why don't we need NAT exemption on ASA in case of Clientless SSL VPN?

2.If exempted from NAT(Cisco anyconnect ssl  vpn),how is the traffic from internal network(private IP )routed on public Internet?

Thanks.

[Karsten Iwen]

1. In clientless VPN, the ASA acts as a proxy and no traffic flows *through* the ASA that could be NATed or be exempted from NAT.
2. By correctly configuring the NAT exemption. There are (minimum) two rules: 
• The exemption rule in section one that only acts when the internal IPs communicate with the Client IPs.
• The general rule (often in section three, but also possible in section two) that translates the rest.