In what situations will an ASA perform route lookup? (transparent mode)
The ASA will perform MAC Address lookup when in transparent mode.
It will do Route lookup only for the following reasons;
- Traffic that originate from the ASA (Syslog for example).
- Traffic that is one hop away from the ASA with NAT enabled.
- VoIP and DNS traffic with inspection enabled and endpoint is one hop away from the ASA.
Source: Cisco's own doc
Second situation in detail
Again, source: Cisco's own doc
In a nutshell, when the host 192.168.1.2 goes out to reach www.example.com, it will be NATed behind 188.8.131.52.
When the packets come back, the destination is...of course...184.108.40.206. The transparent firewall will "De-Nat" the packet with destination 192.168.1.2.
Since it does not have a MAC address for that specific host (because of the router between the host and the firewall) it will look in it's routing table and send the packets to 10.1.1.3.