Identity NAT and NAT exempt are commonly considered the same kind of ‘no natting’ configuration when in practice both methods are configured slightly different as well as firewall’s internal processing.

Identity NAT configuration

nat (inside) 0 10.1.1.3

NAT Exempt configuration

access-list NO_NAT extended permit ip 192.168.0.0 255.255.255.0 10.10.10.0 255.255.255.0
nat(inside) 0 access-list NO_NAT

Identity NAT:
– works only one way (in dirrection specified)
– appear in xlate table

NAT exempt:
– works bidirrectional
– does not appear in xlate table

Note:Identity NAT is not going to work for L2L VPN as work one way only and that’s why we always should use NAT Exempt (with the access list) to allow bidirectional communication.

Follow me!