I am completing a lab and have been told I should ALWAYS block Egress traffic from private address ranges.
The ASA performs NAT translation of private IPs to the public IP address assigned to the 'outside' interface so this is therefore taken care of isn't it?
In which scenario could the source IP contain a private address? I assume only if no NAT translation takes place?
Could I somehow get past the ASA NAT translation by using IP spoofing? Surely, if the ASA is performing NAT translation to a public IP this not really of any benefit unless we wish to hide the internal IP address of a malicious user so returning traffic believes it originated from a different machine?