ASA Dynamic NAT problems after config of statics

Unanswered Question
May 26th, 2010
User Badges:

Hello,


I'm configuring a asa 5510.


I have a dynamic NAT rule configured:


NAT (INSIDE) 1 0.0.0.0 0.0.0.0

global (outside) 1 interface


On the interface of the outside the IP adress 192.168.1.1 is configured.


With only this config the PAT translation works between the inside and outside interface. inside network is the 10.1.0.0/16 network.

If I try the packet trace with the inside address 10.1.1.4 tot the outside interface


Now I configured an additional static nat entry on the inside interface to the outside interface.


static (inside,outside) 192.168.1.51 10.1.1.1 netmask 255.255.255.255


The static is working, but the dynamic not more!?

It is not working according the packet trace, it fails in the nat translation.


Anyone encountered this problem? I'm running version 8.2(2).


Greetings,


Marcel

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
Federico Coto F... Wed, 05/26/2010 - 13:32
User Badges:
  • Green, 3000 points or more

Hi,


If you remove the static it works again?


no static (inside,outside) 192.168.1.51 10.1.1.1


The static should not affect the dynamic NAT since the static only affects traffic to 10.1.1.1 using IP 192.168.1.51


Can you try it again?


Federico.

m.slotboom Wed, 05/26/2010 - 13:50
User Badges:

Yes correct.


when I remove the static it works again.

It must indeed not affect the dynamic rule, but some how it does.


I've tried a clear xlate but with no effect.


Best regards,


Marcel

Federico Coto F... Wed, 05/26/2010 - 14:53
User Badges:
  • Green, 3000 points or more

If the outside IP of the ASA is 192.168.1.1, then using 192.168.1.51 on the static NAT is no problem.

How about you try creating a different static using a different IP 192.168.1.x?  same result?


Federico.

m.slotboom Thu, 05/27/2010 - 14:58
User Badges:

The problem is solved.


It was the syntax of the packet tracer.

it was not a physical problem.


When I do a packet trace from the ASDM for IP traffic


It sends a 'rawip' command, this doesn't work for a PAT translate.

Because a PAT translate needs udp or tcp ports before it can translate.


But I can't find it in any documentation and in the SNAF and SNAA courses it is not mentioned.

I found it after a TAC request to Cisco.


Regards,


Marcel

Actions

This Discussion