Double PAT Problems

Unanswered Question
May 24th, 2009



Host -> FWSM -> Cat65K (Host Source IP PAT'ed on SVI) -> ASA 2 -> ASA 1 (Source IP again PAT'ed on outside interface -> Internet

I am not able to access the internet with the above. Only built connection logs can be seen on all the firewalls and after some wait a TCP Reset-O is seen on them. I ran a sniffer on the host and noticed that the initial SYN, SYN/ACK, ACK goes thru but then the host goes into a loop of TCP Retransmission/Dup ACK and the destination never responds.

Can dual PAT'ing on the way out to the internet can cause such problems. For some reason, the destination does not recognize any exchange after the initial TCP handshake.

Please assist.


I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Sun, 05/24/2009 - 12:15

There is no reason in theory why dual patting should not work. In fact from memory i believe i have done this before without issue.

What does the translation table look like on both the 6500 and the ASA ?



This Discussion