Identity NAT: exempting traffic from a broader rule

Identity NAT translates an address to itself. Stated that way it sounds like a no-op, and the first question everyone asks is why a rule that changes nothing needs to exist at all.

Identity NAT exemption: three columns comparing no exemption, an exemption placed after-auto in Section 3, below the broad object rule in Section 2 that still matches first, and the same exemption as Manual NAT in Section 1 - with the three NAT sections named beneath

It is not a default for unmatched traffic. Traffic that matches no NAT rule already crosses the firewall untouched — you never need a rule to make nothing happen. Identity NAT’s most common job is the opposite situation: when a broad rule would match traffic you need left alone, and you have to carve that traffic out of it.

The classic case is a VPN. A wide dynamic PAT rule for an inside subnet happily translates traffic bound for the far end of a tunnel, because that traffic is sourced from the inside subnet like everything else. The far end then receives packets from an address its crypto selectors do not recognise, and the tunnel passes nothing. Nothing in the logs says “NAT did this” — the failure reads like a crypto problem and burns hours in the wrong subsystem.

The exemption is a rule that says this source, to that destination, keeps its address.

Key Insight

An exemption that does not outrank the rule it exempts from is not an exemption. First match wins, so the broad rule matches first and the identity rule never runs. Placement is the whole mechanism — on Cisco Secure Firewall that means Manual NAT in Section 1, above the object rules in Section 2.

Two consequences worth carrying:

Order is not a detail here. Getting the rule right and the section wrong produces exactly the outage the rule was written to prevent.
It is verifiable before any traffic flows. An identity rule creates a translation entry you can read immediately, so you can prove the exemption exists without standing up the tunnel first.