In what situations will an ASA perform route lookup? (transparent mode)

  • I don't think it does that except for management traffic if you can call this so. How did you come on this?
    – laf
    Commented Jul 25, 2013 at 11:56
  • It does. I have found the question on exam.
    – hell yeah
    Commented Jul 25, 2013 at 15:06

1 Answer 1


Primary answer

The ASA will perform MAC Address lookup when in transparent mode.

It will do Route lookup only for the following reasons;

  1. Traffic that originate from the ASA (Syslog for example).
  2. Traffic that is one hop away from the ASA with NAT enabled.
  3. VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.

Source: Cisco's own doc

Second situation in detail

Again, source: Cisco's own doc

enter image description here

In a nutshell, when the host goes out to reach www.example.com, it will be NATed behind

When the packets come back, the destination is...of course... The transparent firewall will "De-Nat" the packet with destination

Since it does not have a MAC address for that specific host (because of the router between the host and the firewall) it will look in it's routing table and send the packets to

  • Can you explain 2) in detail?
    – hell yeah
    Commented Jul 25, 2013 at 17:07
  • What if traffic is one hop away from ASA without NAT enabled.
    – hell yeah
    Commented Jul 26, 2013 at 5:51

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.