Filter
Top Products
21-32
Cisco ASDM User Guide
OL-16647-01
Chapter 21 Configuring NAT
Using NAT Exemption
• Maximum Embryonic Connections—Specifies the maximum number of embryonic connections
per host up to 65,536. An embryonic connection is a connection request that has not finished the
necessary handshake between source and destination. This limit enables the TCP Intercept feature.
The default is 0, which means the maximum embryonic connections. TCP Intercept protects inside
systems from a DoS attack perpetrated by flooding an interface with TCP SYN packets. When the
embryonic limit has been surpassed, the TCP intercept feature intercepts TCP SYN packets from
clients to servers on a higher security level. SYN cookies are used during the validation process and
help to minimize the amount of valid traffic being dropped. Thus, connection attempts from
unreachable hosts will never reach the server.
Step 11 Click OK.
Using NAT Exemption
NAT exemption exempts addresses from translation and allows both real and remote hosts to originate
connections. NAT exemption lets you specify the real and destination addresses when determining the
real traffic to exempt (similar to policy NAT), so you have greater control using NAT exemption than
dynamic identity NAT. However unlike policy NAT, NAT exemption does not consider the ports. Use
static policy identity NAT to consider ports.
For more information about NAT exemption, see the “Bypassing NAT When NAT Control is Enabled”
section on page 21-10.
Figure 21-23 shows a typical NAT exemption scenario.
Figure 21-23 NAT Exemption
To configure NAT exemption, perform the following steps:
Step 1 From the Configuration > Firewall > NAT Rules pane, choose Add > Add NAT Exempt Rule.
The Add NAT Exempt Rule dialog box appears.
Step 2 Click Action: Exempt.
Step 3 In the Original area, from the Interface drop-down list, choose the interface that is connected to the hosts
with real addresses that you want to exempt.
Step 4 Enter the real addresses in the Source field, or click the ... button to choose an IP address that you already
defined in ASDM.
Specify the address and subnet mask using prefix/length notation, such as 10.1.1.0/24. If you enter an
IP address without a mask, it is considered to be a host address, even if it ends with a 0.
209.165.201.1 209.165.201.1
Inside Outside
209.165.201.2 209.165.201.2
130036
Security
Appliance