Modern Approach to Identity NAT (NAT 0) in Cisco ASA

Identity NAT (Formerly NAT 0) in Modern Cisco ASA (8.3+) – Part 1

Table of Contents

• Introduction
• History of NAT 0
• Why Identity NAT Exists
• Packet Flow
• Mathematics Behind NAT
• Legacy Configuration
• Modern Object NAT

Deep Dive into Cisco ASA Identity NAT Processing

Understanding Identity NAT requires more than simply memorizing configuration syntax. Network engineers should understand how Cisco Adaptive Security Appliance (ASA) evaluates packets internally, how the unified NAT engine processes translations, and why Identity NAT is fundamental to successful VPN communication. Although commonly referred to as "NAT exemption," Identity NAT is actually a valid NAT policy that intentionally preserves original IP addresses rather than translating them.

Before Cisco ASA version 8.3, administrators configured NAT exemption using the nat 0 command. Beginning with ASA 8.3, Cisco introduced the Unified NAT Engine, replacing the legacy syntax with object-based configuration and Manual (Twice) NAT rules. While the configuration method changed, the underlying goal remained the same—allow selected traffic to bypass address translation.

How Cisco ASA Processes Packets

When a packet enters an ASA interface, the firewall performs several processing stages before forwarding it. Understanding these stages helps administrators troubleshoot NAT, ACL, and VPN issues efficiently.

1. Packet enters the ingress interface.
2. The routing table is consulted.
3. Manual NAT (Section 1) rules are evaluated.
4. Auto NAT (Section 2) rules are evaluated if necessary.
5. After NAT processing, ACL and security policy evaluation occurs.
6. If traffic matches a VPN crypto ACL, encryption begins.
7. The packet exits through the egress interface.

Identity NAT Packet Flow

Inside Host
     │
     ▼
Ingress Interface
     │
     ▼
Manual NAT Evaluation
     │
     ▼
Identity NAT Rule Matches
     │
     ▼
No Address Translation
     │
     ▼
VPN Crypto ACL Match
     │
     ▼
IPsec Encryption
     │
     ▼
Outside Interface

Mathematical Representation

Identity NAT behaves exactly like the mathematical identity function.

f(x)=x

Where:

• x = Original IP address
• f(x) = Output after NAT processing

Because the input equals the output, the packet retains its original addressing throughout the NAT phase.

For example:

Original Address	Translated Address
192.168.1.10	192.168.1.10
10.1.102.15	10.1.102.15

The mapping function can therefore be expressed as:

Translation(IP)=Original(IP)

This mathematical property explains why Identity NAT is mandatory for most site-to-site VPN deployments.

Configuration Example

object network LOCAL_NET
 subnet 192.168.1.0 255.255.255.0

object network REMOTE_NET
 subnet 10.1.102.0 255.255.255.0

nat (inside,outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET

CLI Verification

ASA# show nat

Manual NAT Policies (Section 1)

1 (inside) to (outside)
source static LOCAL_NET LOCAL_NET
destination static REMOTE_NET REMOTE_NET

translate_hits = 142
untranslate_hits = 142

Why are translate_hits increasing if nothing is translated?

The ASA NAT engine still evaluates the Identity NAT rule. Although the source and destination remain unchanged, the packet still matches a NAT policy. Therefore, the firewall increments the translation counters to indicate successful rule evaluation.

Why VPNs Require Identity NAT

IPsec VPNs depend on matching encryption domains. The local firewall and remote firewall must agree on the source and destination networks before encryption occurs.

Suppose the local network is 192.168.1.0/24 and the remote network is 10.1.102.0/24.

If Dynamic PAT changes the packet to the public IP address before encryption, the packet no longer matches the crypto ACL.

Without Identity NAT	With Identity NAT
Packet becomes Public IP	Packet remains Private IP
Crypto ACL fails	Crypto ACL matches
VPN Tunnel fails	VPN Tunnel succeeds

Enterprise Example

Consider an organization with two offices connected through an IPsec tunnel.

• Headquarters : 10.10.10.0/24
• Branch Office : 172.16.10.0/24

Employees at the branch office need to access servers located at headquarters. Because both sites use private IP addressing, translating either network before encryption would prevent the VPN from matching its encryption domain.

object network HQ_NETWORK
 subnet 10.10.10.0 255.255.255.0

object network BRANCH_NETWORK
 subnet 172.16.10.0 255.255.255.0

nat (inside,outside) source static BRANCH_NETWORK BRANCH_NETWORK destination static HQ_NETWORK HQ_NETWORK

Verification Output

ASA# show crypto ipsec sa

local ident : 172.16.10.0/24
remote ident: 10.10.10.0/24

pkts encaps : 5289
pkts encrypt: 5289
pkts decrypt: 5278
pkts decaps : 5278

Understanding the Output

• The local identity represents the protected local subnet.
• The remote identity represents the protected remote subnet.
• Increasing encapsulation counters indicate successful outbound encryption.
• Increasing decapsulation counters indicate successful inbound decryption.
• Balanced counters generally indicate a healthy VPN tunnel.

Identity NAT vs Dynamic PAT

Feature	Identity NAT	Dynamic PAT
Changes Address	No	Yes
VPN Friendly	Yes	No
Uses Public Address	No	Yes
Common Usage	VPN Traffic	Internet Access

Common Verification Commands

show nat
show nat detail
show xlate
show access-list
show crypto ipsec sa
show crypto ikev2 sa
packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed

Sample Packet-Tracer Output

ASA# packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed

Phase: 1
Type: NAT
Result: ALLOW

Matched Identity NAT Rule

Phase: 2
Type: VPN

Result: Encrypt

Final Result:
ALLOW

How Packet-Tracer Helps

Packet-Tracer simulates packet movement through the ASA without sending live traffic. Engineers can identify NAT mismatches, ACL problems, routing issues, and VPN failures before deploying changes into production. It is one of the most valuable troubleshooting utilities available on Cisco ASA.

Common Configuration Mistakes

• Creating incorrect network objects.
• Placing Identity NAT after conflicting Manual NAT rules.
• Crypto ACLs referencing different subnets.
• Incorrect interface selection.
• Missing routing information.
• Using Dynamic PAT for VPN traffic.
• Forgetting to save the configuration.

Key Takeaways

• Identity NAT replaces legacy NAT 0 in Cisco ASA 8.3 and later.
• The unified NAT engine evaluates Identity NAT as a valid NAT policy even though addresses remain unchanged.
• VPN traffic normally requires Identity NAT so that encryption domains remain consistent.
• Packet-Tracer is the fastest way to validate NAT and VPN policy processing.
• Manual NAT rules have higher priority than Auto NAT rules.
• Understanding packet flow significantly reduces troubleshooting time.
• Always verify configurations using show nat, show xlate, and show crypto ipsec sa.

Introduction

This is Part 1 of a larger educational article. It introduces the evolution from NAT 0 to Identity NAT in Cisco ASA versions 8.3 and later, explains the concepts, and prepares for advanced VPN scenarios covered in later parts.

Mathematics Behind NAT

Identity NAT can be viewed as a mapping function:

f(IP)=IP

Unlike traditional NAT where f(IP)=Translated IP, Identity NAT preserves the address.

Legacy NAT 0 Example

access-list NAT0_ACL permit ip 192.168.1.0 255.255.255.0 10.1.102.0 255.255.255.0
nat (inside) 0 access-list NAT0_ACL

CLI Output Sample

ASA# show nat

Auto NAT Policies (Section 2)
No translation for matched VPN traffic.

Why use Identity NAT?

VPN encryption domains require original addresses. Identity NAT ensures packets match crypto ACLs without translation.

Key Takeaways

• Identity NAT replaces NAT 0.
• Object-based NAT is easier to manage.
• Twice NAT provides greater flexibility.

Modern Identity NAT (Cisco ASA 8.3 and Later)

Beginning with Cisco ASA 8.3, NAT configuration changed significantly. Legacy NAT 0 was replaced by Identity NAT using network objects and manual (twice) NAT rules.

Code Example

object network INSIDE_NET
 subnet 192.168.1.0 255.255.255.0

object network OUTSIDE_NET
 subnet 10.1.102.0 255.255.255.0

nat (inside,outside) source static INSIDE_NET INSIDE_NET destination static OUTSIDE_NET OUTSIDE_NET

CLI Output Sample

ASA# show nat

Manual NAT Policies (Section 1)
1 (inside) to (outside)
source static INSIDE_NET INSIDE_NET
destination static OUTSIDE_NET OUTSIDE_NET
translate_hits = 25, untranslate_hits = 25

Why use Twice NAT?

Twice NAT evaluates both source and destination simultaneously, making it ideal for VPN traffic, overlapping networks, and advanced translation scenarios.

Packet Flow

• Packet enters inside interface.
• Manual NAT rules are evaluated.
• Identity NAT matches.
• No address translation occurs.
• Packet matches the VPN crypto ACL.
• Traffic is encrypted and forwarded.

Mathematical Representation

Identity NAT behaves as an identity function:

f(x)=x

Where x represents the original IP address. Since the output equals the input, no translation occurs and VPN peer matching remains intact.

Key Takeaways

• Identity NAT is the replacement for NAT 0.
• Object-based NAT improves scalability.
• Manual NAT has higher priority than Auto NAT.
• VPN traffic should normally avoid address translation.

VPN Scenarios, Verification and Troubleshooting

Identity NAT is most commonly deployed with site-to-site IPsec VPNs to ensure packets retain their original IP addresses before encryption.

Code Example

access-list VPN_ACL extended permit ip 192.168.1.0 255.255.255.0 10.1.102.0 255.255.255.0

crypto map VPN_MAP 10 match address VPN_ACL
crypto map VPN_MAP 10 set peer 203.0.113.10
crypto map VPN_MAP 10 set transform-set ESP-AES-SHA
crypto map VPN_MAP interface outside

CLI Output Sample

ASA# show crypto ipsec sa

local ident : 192.168.1.0/24
remote ident: 10.1.102.0/24

pkts encaps: 1520
pkts decaps: 1518
pkts encrypt: 1520
pkts decrypt: 1518

Common Configuration Mistakes

• Identity NAT placed after conflicting NAT rules.
• Crypto ACL does not match Identity NAT networks.
• Incorrect network objects.
• NAT exemption configured on the wrong interfaces.
• VPN peer has mismatched encryption domains.

Mathematical Explanation

Success (%) = (Successful Matches / Total Sessions) × 100

Key Takeaways

• Verify with show nat, show xlate, and packet-tracer.
• Identity NAT must align with the VPN encryption domain.
• Testing before deployment reduces outages.

Performance, Best Practices, FAQs and Conclusion

Identity NAT is a critical feature in modern Cisco ASA deployments, especially when integrating IPsec VPNs, overlapping networks, and advanced manual NAT policies. Understanding NAT processing order and verification techniques helps prevent configuration errors and simplifies troubleshooting.

Code Example

show nat detail
show xlate
show asp drop
show conn
show route
packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed

Sample CLI Output

ASA# show nat detail

Manual NAT Policies (Section 1)
Hits: 328
Identity NAT Rule: Active

ASA# show xlate

0 in use, 0 most used
Identity translations are exempt from address rewriting.

Performance Recommendations

• Review NAT policies regularly to remove unused rules.
• Place the most frequently matched manual NAT rules in an appropriate order.
• Use descriptive object names and comments to simplify maintenance.
• Validate every policy change with packet-tracer before production deployment.
• Monitor VPN statistics after changes to confirm successful traffic flow.

Learning Formula

The efficiency of a deployment can be estimated using:

Efficiency (%) = (Successful VPN Sessions ÷ Total VPN Sessions) × 100

Although simplified, this equation illustrates the importance of correctly matching Identity NAT rules with VPN encryption domains. A mismatch reduces successful session establishment and may cause traffic to bypass the tunnel.

Frequently Asked Questions

Does Identity NAT translate packets?

No. Identity NAT explicitly preserves the original source and destination addresses.

Why was NAT 0 removed?

Cisco introduced a unified NAT framework in ASA 8.3 that supports Auto NAT, Manual (Twice) NAT, Static NAT, Dynamic NAT, and Identity NAT using a consistent syntax.

Can Identity NAT be used without a VPN?

Yes. Although most commonly associated with VPN deployments, Identity NAT can also preserve addresses in specialized routing and firewall designs.

Key Takeaways

• Identity NAT is the modern replacement for legacy NAT 0.
• Manual (Twice) NAT offers precise control over source and destination matching.
• Network objects simplify configuration management.
• Verification commands are essential during deployment and troubleshooting.
• Correct NAT ordering ensures predictable packet processing.
• Identity NAT is fundamental to successful IPsec VPN operation.

Conclusion

Modern Cisco ASA software replaces the legacy NAT 0 mechanism with Identity NAT implemented through the unified NAT engine. By using object-based configuration and Manual (Twice) NAT rules, administrators gain greater flexibility, scalability, and visibility into packet processing. When properly designed, Identity NAT ensures that VPN traffic maintains its original addressing, allowing encryption domains to match correctly and enabling secure communication between private networks.

Appendix: Cisco ASA Identity NAT Reference

Quick Configuration Checklist

• Create network objects for local and remote networks.
• Create an Identity NAT (Manual/Twice NAT) rule.
• Ensure the VPN crypto ACL matches the same subnets.
• Apply the crypto map to the outside interface.
• Verify with show nat, show crypto ipsec sa, and packet-tracer.

Configuration Template

object network LOCAL_NET
 subnet 192.168.1.0 255.255.255.0

object network REMOTE_NET
 subnet 10.1.102.0 255.255.255.0

nat (inside,outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET

Deployment Checklist

• Verify routing before testing NAT.
• Confirm ACL and NAT objects reference identical networks.
• Review NAT rule order.
• Validate tunnel establishment.
• Save the configuration after testing.

Final Study Notes

• Identity NAT preserves IP addresses.
• Manual NAT is processed before Auto NAT.
• Packet Tracer is the fastest way to validate policy flow.

Appendix: Interview Questions and Hands-on Lab

Practice Configuration

!
object network BRANCH_LAN
 subnet 172.16.10.0 255.255.255.0

object network HQ_LAN
 subnet 10.10.10.0 255.255.255.0

nat (inside,outside) source static BRANCH_LAN BRANCH_LAN destination static HQ_LAN HQ_LAN
!

Expected Verification Output

ASA# show nat

Manual NAT Policies (Section 1)
Identity NAT rule matched.
translate_hits = 150
untranslate_hits = 150

10 Interview Questions

1. What replaced NAT 0 in ASA 8.3+?
2. What is Identity NAT?
3. When should Manual NAT be used?
4. What is Twice NAT?
5. How is NAT order evaluated?
6. Why is Identity NAT important for VPNs?
7. Which command verifies NAT rules?
8. What does show xlate display?
9. How does Packet Tracer help?
10. What happens if Crypto ACLs and Identity NAT don't match?

Lab Exercise

• Create two network objects.
• Configure an Identity NAT rule.
• Build a site-to-site VPN.
• Run packet-tracer.
• Verify counters with show nat.

End of Appendix.

Advanced Identity NAT Reference and Real-World Scenarios

This appendix provides additional study material for engineers preparing for Cisco ASA administration, troubleshooting, and certification exams.

Enterprise Example

!
object network DC_NET
 subnet 10.100.0.0 255.255.0.0

object network DR_NET
 subnet 10.200.0.0 255.255.0.0

nat (inside,outside) source static DC_NET DC_NET destination static DR_NET DR_NET
!

Expected CLI Output

ASA# show nat detail

Manual NAT Policies (Section 1)
Identity NAT
translate_hits   : 548
untranslate_hits : 548

Advanced Troubleshooting Checklist

• Verify interface routing.
• Confirm object definitions.
• Check NAT rule precedence.
• Validate crypto ACL symmetry.
• Inspect IPsec Security Associations.
• Run Packet Tracer for policy simulation.
• Review ASP drop counters.
• Check translation hit counters after testing.

Common Show Commands

• show nat detail
• show xlate
• show access-list
• show crypto ikev2 sa
• show crypto ipsec sa
• show asp drop
• packet-tracer

Final Revision Notes

• Identity NAT preserves original addressing.
• Manual (Twice) NAT is evaluated before Auto NAT.
• VPN encryption domains and Identity NAT must reference identical networks.
• Verification should always include NAT, routing, and IPsec status.