Identity NAT (Formerly NAT 0) in Modern Cisco ASA (8.3+) – Part 1
Deep Dive into Cisco ASA Identity NAT Processing
Understanding Identity NAT requires more than simply memorizing configuration syntax. Network engineers should understand how Cisco Adaptive Security Appliance (ASA) evaluates packets internally, how the unified NAT engine processes translations, and why Identity NAT is fundamental to successful VPN communication. Although commonly referred to as "NAT exemption," Identity NAT is actually a valid NAT policy that intentionally preserves original IP addresses rather than translating them.
Before Cisco ASA version 8.3, administrators configured NAT exemption using the nat 0 command. Beginning with ASA 8.3, Cisco introduced the Unified NAT Engine, replacing the legacy syntax with object-based configuration and Manual (Twice) NAT rules. While the configuration method changed, the underlying goal remained the same—allow selected traffic to bypass address translation.
How Cisco ASA Processes Packets
When a packet enters an ASA interface, the firewall performs several processing stages before forwarding it. Understanding these stages helps administrators troubleshoot NAT, ACL, and VPN issues efficiently.
- Packet enters the ingress interface.
- The routing table is consulted.
- Manual NAT (Section 1) rules are evaluated.
- Auto NAT (Section 2) rules are evaluated if necessary.
- After NAT processing, ACL and security policy evaluation occurs.
- If traffic matches a VPN crypto ACL, encryption begins.
- The packet exits through the egress interface.
Identity NAT Packet Flow
Inside Host
│
▼
Ingress Interface
│
▼
Manual NAT Evaluation
│
▼
Identity NAT Rule Matches
│
▼
No Address Translation
│
▼
VPN Crypto ACL Match
│
▼
IPsec Encryption
│
▼
Outside Interface
Mathematical Representation
Identity NAT behaves exactly like the mathematical identity function.
f(x)=x
Where:
- x = Original IP address
- f(x) = Output after NAT processing
Because the input equals the output, the packet retains its original addressing throughout the NAT phase.
For example:
| Original Address | Translated Address |
|---|---|
| 192.168.1.10 | 192.168.1.10 |
| 10.1.102.15 | 10.1.102.15 |
The mapping function can therefore be expressed as:
Translation(IP)=Original(IP)
This mathematical property explains why Identity NAT is mandatory for most site-to-site VPN deployments.
Configuration Example
object network LOCAL_NET
subnet 192.168.1.0 255.255.255.0
object network REMOTE_NET
subnet 10.1.102.0 255.255.255.0
nat (inside,outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET
CLI Verification
ASA# show nat Manual NAT Policies (Section 1) 1 (inside) to (outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET translate_hits = 142 untranslate_hits = 142
Why are translate_hits increasing if nothing is translated?
The ASA NAT engine still evaluates the Identity NAT rule. Although the source and destination remain unchanged, the packet still matches a NAT policy. Therefore, the firewall increments the translation counters to indicate successful rule evaluation.
Why VPNs Require Identity NAT
IPsec VPNs depend on matching encryption domains. The local firewall and remote firewall must agree on the source and destination networks before encryption occurs.
Suppose the local network is 192.168.1.0/24 and the remote network is 10.1.102.0/24.
If Dynamic PAT changes the packet to the public IP address before encryption, the packet no longer matches the crypto ACL.
| Without Identity NAT | With Identity NAT |
|---|---|
| Packet becomes Public IP | Packet remains Private IP |
| Crypto ACL fails | Crypto ACL matches |
| VPN Tunnel fails | VPN Tunnel succeeds |
Enterprise Example
Consider an organization with two offices connected through an IPsec tunnel.
- Headquarters : 10.10.10.0/24
- Branch Office : 172.16.10.0/24
Employees at the branch office need to access servers located at headquarters. Because both sites use private IP addressing, translating either network before encryption would prevent the VPN from matching its encryption domain.
object network HQ_NETWORK
subnet 10.10.10.0 255.255.255.0
object network BRANCH_NETWORK
subnet 172.16.10.0 255.255.255.0
nat (inside,outside) source static BRANCH_NETWORK BRANCH_NETWORK destination static HQ_NETWORK HQ_NETWORK
Verification Output
ASA# show crypto ipsec sa local ident : 172.16.10.0/24 remote ident: 10.10.10.0/24 pkts encaps : 5289 pkts encrypt: 5289 pkts decrypt: 5278 pkts decaps : 5278
Understanding the Output
- The local identity represents the protected local subnet.
- The remote identity represents the protected remote subnet.
- Increasing encapsulation counters indicate successful outbound encryption.
- Increasing decapsulation counters indicate successful inbound decryption.
- Balanced counters generally indicate a healthy VPN tunnel.
Identity NAT vs Dynamic PAT
| Feature | Identity NAT | Dynamic PAT |
|---|---|---|
| Changes Address | No | Yes |
| VPN Friendly | Yes | No |
| Uses Public Address | No | Yes |
| Common Usage | VPN Traffic | Internet Access |
Common Verification Commands
show nat
show nat detail
show xlate
show access-list
show crypto ipsec sa
show crypto ikev2 sa
packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed
Sample Packet-Tracer Output
ASA# packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed Phase: 1 Type: NAT Result: ALLOW Matched Identity NAT Rule Phase: 2 Type: VPN Result: Encrypt Final Result: ALLOW
How Packet-Tracer Helps
Packet-Tracer simulates packet movement through the ASA without sending live traffic. Engineers can identify NAT mismatches, ACL problems, routing issues, and VPN failures before deploying changes into production. It is one of the most valuable troubleshooting utilities available on Cisco ASA.
Common Configuration Mistakes
- Creating incorrect network objects.
- Placing Identity NAT after conflicting Manual NAT rules.
- Crypto ACLs referencing different subnets.
- Incorrect interface selection.
- Missing routing information.
- Using Dynamic PAT for VPN traffic.
- Forgetting to save the configuration.
Key Takeaways
- Identity NAT replaces legacy NAT 0 in Cisco ASA 8.3 and later.
- The unified NAT engine evaluates Identity NAT as a valid NAT policy even though addresses remain unchanged.
- VPN traffic normally requires Identity NAT so that encryption domains remain consistent.
- Packet-Tracer is the fastest way to validate NAT and VPN policy processing.
- Manual NAT rules have higher priority than Auto NAT rules.
- Understanding packet flow significantly reduces troubleshooting time.
- Always verify configurations using
show nat,show xlate, andshow crypto ipsec sa.
Introduction
This is Part 1 of a larger educational article. It introduces the evolution from NAT 0 to Identity NAT in Cisco ASA versions 8.3 and later, explains the concepts, and prepares for advanced VPN scenarios covered in later parts.
Mathematics Behind NAT
Identity NAT can be viewed as a mapping function:
f(IP)=IP
Unlike traditional NAT where f(IP)=Translated IP, Identity NAT preserves the address.
Legacy NAT 0 Example
access-list NAT0_ACL permit ip 192.168.1.0 255.255.255.0 10.1.102.0 255.255.255.0
nat (inside) 0 access-list NAT0_ACLCLI Output Sample
ASA# show nat Auto NAT Policies (Section 2) No translation for matched VPN traffic.
Why use Identity NAT?
VPN encryption domains require original addresses. Identity NAT ensures packets match crypto ACLs without translation.
Key Takeaways
- Identity NAT replaces NAT 0.
- Object-based NAT is easier to manage.
- Twice NAT provides greater flexibility.
Modern Identity NAT (Cisco ASA 8.3 and Later)
Beginning with Cisco ASA 8.3, NAT configuration changed significantly. Legacy NAT 0 was replaced by Identity NAT using network objects and manual (twice) NAT rules.
Code Example
object network INSIDE_NET
subnet 192.168.1.0 255.255.255.0
object network OUTSIDE_NET
subnet 10.1.102.0 255.255.255.0
nat (inside,outside) source static INSIDE_NET INSIDE_NET destination static OUTSIDE_NET OUTSIDE_NET
CLI Output Sample
ASA# show nat Manual NAT Policies (Section 1) 1 (inside) to (outside) source static INSIDE_NET INSIDE_NET destination static OUTSIDE_NET OUTSIDE_NET translate_hits = 25, untranslate_hits = 25
Why use Twice NAT?
Twice NAT evaluates both source and destination simultaneously, making it ideal for VPN traffic, overlapping networks, and advanced translation scenarios.
Packet Flow
- Packet enters inside interface.
- Manual NAT rules are evaluated.
- Identity NAT matches.
- No address translation occurs.
- Packet matches the VPN crypto ACL.
- Traffic is encrypted and forwarded.
Mathematical Representation
Identity NAT behaves as an identity function:
f(x)=x
Where x represents the original IP address. Since the output equals the input, no translation occurs and VPN peer matching remains intact.
Key Takeaways
- Identity NAT is the replacement for NAT 0.
- Object-based NAT improves scalability.
- Manual NAT has higher priority than Auto NAT.
- VPN traffic should normally avoid address translation.
VPN Scenarios, Verification and Troubleshooting
Identity NAT is most commonly deployed with site-to-site IPsec VPNs to ensure packets retain their original IP addresses before encryption.
Code Example
access-list VPN_ACL extended permit ip 192.168.1.0 255.255.255.0 10.1.102.0 255.255.255.0
crypto map VPN_MAP 10 match address VPN_ACL
crypto map VPN_MAP 10 set peer 203.0.113.10
crypto map VPN_MAP 10 set transform-set ESP-AES-SHA
crypto map VPN_MAP interface outsideCLI Output Sample
ASA# show crypto ipsec sa local ident : 192.168.1.0/24 remote ident: 10.1.102.0/24 pkts encaps: 1520 pkts decaps: 1518 pkts encrypt: 1520 pkts decrypt: 1518
Common Configuration Mistakes
- Identity NAT placed after conflicting NAT rules.
- Crypto ACL does not match Identity NAT networks.
- Incorrect network objects.
- NAT exemption configured on the wrong interfaces.
- VPN peer has mismatched encryption domains.
Mathematical Explanation
Success (%) = (Successful Matches / Total Sessions) × 100
Key Takeaways
- Verify with
show nat,show xlate, andpacket-tracer. - Identity NAT must align with the VPN encryption domain.
- Testing before deployment reduces outages.
Performance, Best Practices, FAQs and Conclusion
Identity NAT is a critical feature in modern Cisco ASA deployments, especially when integrating IPsec VPNs, overlapping networks, and advanced manual NAT policies. Understanding NAT processing order and verification techniques helps prevent configuration errors and simplifies troubleshooting.
Code Example
show nat detail
show xlate
show asp drop
show conn
show route
packet-tracer input inside icmp 192.168.1.10 8 0 10.1.102.10 detailed
Sample CLI Output
ASA# show nat detail Manual NAT Policies (Section 1) Hits: 328 Identity NAT Rule: Active ASA# show xlate 0 in use, 0 most used Identity translations are exempt from address rewriting.
Performance Recommendations
- Review NAT policies regularly to remove unused rules.
- Place the most frequently matched manual NAT rules in an appropriate order.
- Use descriptive object names and comments to simplify maintenance.
- Validate every policy change with
packet-tracerbefore production deployment. - Monitor VPN statistics after changes to confirm successful traffic flow.
Learning Formula
The efficiency of a deployment can be estimated using:
Efficiency (%) = (Successful VPN Sessions ÷ Total VPN Sessions) × 100
Although simplified, this equation illustrates the importance of correctly matching Identity NAT rules with VPN encryption domains. A mismatch reduces successful session establishment and may cause traffic to bypass the tunnel.
Frequently Asked Questions
Does Identity NAT translate packets?
No. Identity NAT explicitly preserves the original source and destination addresses.
Why was NAT 0 removed?
Cisco introduced a unified NAT framework in ASA 8.3 that supports Auto NAT, Manual (Twice) NAT, Static NAT, Dynamic NAT, and Identity NAT using a consistent syntax.
Can Identity NAT be used without a VPN?
Yes. Although most commonly associated with VPN deployments, Identity NAT can also preserve addresses in specialized routing and firewall designs.
Key Takeaways
- Identity NAT is the modern replacement for legacy NAT 0.
- Manual (Twice) NAT offers precise control over source and destination matching.
- Network objects simplify configuration management.
- Verification commands are essential during deployment and troubleshooting.
- Correct NAT ordering ensures predictable packet processing.
- Identity NAT is fundamental to successful IPsec VPN operation.
Conclusion
Modern Cisco ASA software replaces the legacy NAT 0 mechanism with Identity NAT implemented through the unified NAT engine. By using object-based configuration and Manual (Twice) NAT rules, administrators gain greater flexibility, scalability, and visibility into packet processing. When properly designed, Identity NAT ensures that VPN traffic maintains its original addressing, allowing encryption domains to match correctly and enabling secure communication between private networks.
Appendix: Cisco ASA Identity NAT Reference
Quick Configuration Checklist
- Create network objects for local and remote networks.
- Create an Identity NAT (Manual/Twice NAT) rule.
- Ensure the VPN crypto ACL matches the same subnets.
- Apply the crypto map to the outside interface.
- Verify with
show nat,show crypto ipsec sa, andpacket-tracer.
Configuration Template
object network LOCAL_NET
subnet 192.168.1.0 255.255.255.0
object network REMOTE_NET
subnet 10.1.102.0 255.255.255.0
nat (inside,outside) source static LOCAL_NET LOCAL_NET destination static REMOTE_NET REMOTE_NET
Deployment Checklist
- Verify routing before testing NAT.
- Confirm ACL and NAT objects reference identical networks.
- Review NAT rule order.
- Validate tunnel establishment.
- Save the configuration after testing.
Final Study Notes
- Identity NAT preserves IP addresses.
- Manual NAT is processed before Auto NAT.
- Packet Tracer is the fastest way to validate policy flow.
Appendix: Interview Questions and Hands-on Lab
Practice Configuration
!
object network BRANCH_LAN
subnet 172.16.10.0 255.255.255.0
object network HQ_LAN
subnet 10.10.10.0 255.255.255.0
nat (inside,outside) source static BRANCH_LAN BRANCH_LAN destination static HQ_LAN HQ_LAN
!Expected Verification Output
ASA# show nat Manual NAT Policies (Section 1) Identity NAT rule matched. translate_hits = 150 untranslate_hits = 150
10 Interview Questions
- What replaced NAT 0 in ASA 8.3+?
- What is Identity NAT?
- When should Manual NAT be used?
- What is Twice NAT?
- How is NAT order evaluated?
- Why is Identity NAT important for VPNs?
- Which command verifies NAT rules?
- What does
show xlatedisplay? - How does Packet Tracer help?
- What happens if Crypto ACLs and Identity NAT don't match?
Lab Exercise
- Create two network objects.
- Configure an Identity NAT rule.
- Build a site-to-site VPN.
- Run
packet-tracer. - Verify counters with
show nat.
End of Appendix.
Advanced Identity NAT Reference and Real-World Scenarios
This appendix provides additional study material for engineers preparing for Cisco ASA administration, troubleshooting, and certification exams.
Enterprise Example
!
object network DC_NET
subnet 10.100.0.0 255.255.0.0
object network DR_NET
subnet 10.200.0.0 255.255.0.0
nat (inside,outside) source static DC_NET DC_NET destination static DR_NET DR_NET
!Expected CLI Output
ASA# show nat detail Manual NAT Policies (Section 1) Identity NAT translate_hits : 548 untranslate_hits : 548
Advanced Troubleshooting Checklist
- Verify interface routing.
- Confirm object definitions.
- Check NAT rule precedence.
- Validate crypto ACL symmetry.
- Inspect IPsec Security Associations.
- Run Packet Tracer for policy simulation.
- Review ASP drop counters.
- Check translation hit counters after testing.
Common Show Commands
show nat detailshow xlateshow access-listshow crypto ikev2 sashow crypto ipsec sashow asp droppacket-tracer
Final Revision Notes
- Identity NAT preserves original addressing.
- Manual (Twice) NAT is evaluated before Auto NAT.
- VPN encryption domains and Identity NAT must reference identical networks.
- Verification should always include NAT, routing, and IPsec status.
