Cisco 7604 Configuration Guide - Page 318

NAT Overview Chapter 16 Configuring NAT To avoid running into the limit, you can disable NAT sessions for untranslated traffic (called xlate bypass). See the "Configuring Xlate Bypass" section on page 16-19 to enable xlate bypass. If you disable NAT control and have untranslated traffic or use NAT exemption, or you enable NAT control and use NAT exemption, then with xlate bypass, the FWSM does not create a session for these types of untranslated traffic. NAT sessions are still created in the following instances: • You configure identity NAT (with or without NAT control). Identity NAT is considered to be a translation. • You use same-security interfaces with NAT control. Traffic between same security interfaces create NAT sessions even when you do not configure NAT for the traffic. To avoid NAT sessions in this case, disable NAT control or use NAT exemption as well as xlate bypass. NAT and PAT Global Pool Usage You can display the current global pool utilization of any given NAT or PAT configuration to identify when the global pool is close to exhaustion and to facilitate tracking. Each configured global node maintains a counter to increment and decrement when an IP address or port is allocated or freed from that global node. The counter also exists on standby devices to track global node utilization upon failover. You can specify a single address (for dynamic PAT) or a range of mapped addresses (for dynamic NAT). See the show global usage command for this example of dynamic NAT global pool usage: hostname(config)# show global usage NAT Global Pool 209.165.201.10-209.165.201.20 ID ---- 1 interface --------- outside In use ------ 1 Most used --------- 1 Total ----- 11 See the show global usage command for this example of dynamic PAT port usage: hostname(config)# show global usage NAT Global Pool 209.165.201.10 ID ---- 2 interface --------- outside In use ------ 896 Most used --------- 896 Total ----64512 NAT and Same Security Level Interfaces NAT is not required between same security level interfaces even if you enable NAT control. You can optionally configure NAT if desired. However, if you configure dynamic NAT when NAT control is enabled, then NAT is required. See the "NAT Control" section on page 16-5 for more information. Also, when you specify a group of IP address(es) for dynamic NAT or PAT on a same security interface, then you must perform NAT on that group of addresses when they access any lower or same security level interface (even when NAT control is not enabled). Traffic identified for static NAT is not affected. See the "Allowing Communication Between Interfaces on the Same Security Level" section on page 6-10 to enable same security communication. Note The FWSM does not support VoIP inspection engines when you configure NAT on same security interfaces. These inspection engines include Skinny, SIP, and H.323. See the "Inspection Engine Overview" section on page 22-2 for supported inspection engines. 16-14 Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Configuration Guide using ASDM OL-20748-01