# Cisco ASA NAT Exemption **URL:** \ **Category:** Lessons Discussion\ **Created:** [November 17, 2020, 11:32am UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850 "2020-11-17T11:32:03Z")\ **Posts on this page:** 6\ **Page:** 2
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [July 25, 2022, 6:08am UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/22 "2022-07-25T06:08:48Z")
Hello Po > [@cpj\_68](#): > > What happened if packets are not encrypted? Will they be dropped automatically? The access list that was created identifies what traffic should be encrypted. Because the traffic does not match the ACL, it is not encrypted. So what happens to unencrypted traffic? It depends. In this particular case, that traffic will be forwarded by ASA1 and it will reach ASA2 because routing between ASA1 and ASA2 will send that traffic correctly. Now, once that traffic reaches ASA2, it will be dropped by ASA2 simply because there is no rule that allows that traffic to enter and be forwarded. > [@cpj\_68](#): > > If we have the access-list to permit traffic from the outside to the inside, does that mean we don’t have to use NAT exemption? Not quite. The goal is to exempt traffic between 192.168.1.0/24 and 192.168.2.0/24 from being translated. When this happens, such traffic matches the ACL, and is encrypted and it reaches its destination. If you were to have an ACL in ASA2 that accepts such traffic, it may reach S2, but the problem is that such traffic remains unencrypted which is not what we want. It may resolve the connectivity problem, but it does not result in the scenario we want. I hope this has been helpful! Laz ---
**Author:** ![raphybondo](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/r/b9e5f3/32.png) [@raphybondo](https://forum.networklessons.com/u/raphybondo)\ **Post date:** [December 23, 2022, 6:31pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/23 "2022-12-23T18:31:13Z")
Hello Rene, I’m getting an error with: ```auto ASA1(config)# crypto ikev2 enable OUTSIDE ERROR: CTM ipsec poll ctl DU_IOCTL_RESUME_POLL ioctl failed. ``` ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [January 2, 2023, 6:44am UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/24 "2023-01-02T06:44:18Z")
Hello Raphy Take a look at this post: > [@Cisco ASA Site-to-Site IKEv1 IPsec VPN](https://forum.networklessons.com/t/cisco-asa-site-to-site-ikev1-ipsec-vpn/825/94): > > Hello Ayong After doing some research, I have found that this is a bug that has to do with version 9.1(5)16 as well as 9.1(7)32. I hope that this isn’t a production device that you are using, because others have experienced this issue which appears with the ASA software upgrade, but does not disappear when they downgrade to a working version. Others have had to open TAC cases to resolve it. Unless I’m mistaken, there doesn’t seem to be any published solution to the issue that I could find, b… I hope this has been helpful! Laz ---
**Author:** ![yannickconnan1](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yannickconnan1](https://forum.networklessons.com/u/yannickconnan1)\ **Post date:** [May 17, 2023, 4:26pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/25 "2023-05-17T16:26:03Z")
Hello teams, I had to append " `no-proxy-arp route-lookup` " to the command "`nat (inside,outside) source static INSIDE INSIDE destination static LAN 2 LAN2` " (same for the second ASAV) to make it work. ---
**Author:** ![lagapidis](https://cdn-forum.networklessons.com/user_avatar/forum.networklessons.com/lagapidis/32/4949_2.png) [@lagapidis](https://forum.networklessons.com/u/lagapidis)\ **Post date:** [May 19, 2023, 5:56am UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/26 "2023-05-19T05:56:42Z")
Hello Yannick If you use the IP addressing scheme as shown in the lesson, you should not need to add these two commands. It should work fine without them. However, if you have modified the addressing scheme, you may need to add them for a couple of reasons. First of all, the `no-proxy-arp` keyword disables proxy ARP for that particular NAT rule. If there are overlapping subnets or certain complex network scenarios, then this command is needed to make it work. Similarly, the `route-lookup` keyword instructs the ASA to force a route lookup to determine the egress interface instead of using the interface specified by the NAT rule. By default, the ASA uses the OUTSIDE interface defined in the NAT rule. If you are connecting the ASAs via another interface, then this may be why this keyword was necessary. In any case, take a look at your config again to verify that there is no IP address overlap, and that the proper interfaces are being referenced in your NAT rules… I hope this has been helpful! Laz ---
**Author:** ![yannickconnan1](https://cdn-forum.networklessons.com/letter_avatar_proxy/v4/letter/y/df705f/32.png) [@yannickconnan1](https://forum.networklessons.com/u/yannickconnan1)\ **Post date:** [May 19, 2023, 7:57pm UTC](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850/27 "2023-05-19T19:57:57Z")
Hello Laz, Thanks for the explanation. I didn’t change anything on my config but now it works well without `no-proxy-arp route-lookup`. Sometines it’s good to shutdown/clear everything (like bgp…), thanks again. [Previous page](https://forum.networklessons.com/t/cisco-asa-nat-exemption/12850.md?page=1)