cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
24720
Views
20
Helpful
8
Replies

%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection denied due to NAT reverse path failure. VPN client issues after 8.3.2 upgrade.

Vindemiatrix
Level 1
Level 1

I recently upgraded to 8.3.2 and I was aware of the NAT changes but even after reading https://supportforums.cisco.com/docs/DOC-12569 I'm still unable to rectify VPN network 192.168.100.0 communication with hosts on 172.16.1.0 and 172.16.9.0. The VPN clients connect from the outside interface and I'm trying to ping hosts on the inside and dmz, 172.16.1.0 and 172.16.9.0 respectably. The VPN client shows the two previously mentioned networks as security routes but still not pong to the ping.

# sh nat

Manual NAT Policies (Section 1)

1 (inside) to (any) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional

    translate_hits = 0, untranslate_hits = 0

2 (inside) to (any) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional

    translate_hits = 0, untranslate_hits = 0

3 (inside) to (any) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-172.16.12.0 obj-172.16.12.0 unidirectional

    translate_hits = 0, untranslate_hits = 0

4 (dmz) to (outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional

    translate_hits = 0, untranslate_hits = 0

5 (dmz) to (outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-172.16.12.0 obj-172.16.12.0 unidirectional

    translate_hits = 0, untranslate_hits = 0

Auto NAT Policies (Section 2)

1 (dmz) to (outside) source static obj-172.16.9.5 interface service tcp www www

    translate_hits = 0, untranslate_hits = 142

2 (dmz) to (outside) source static obj-172.16.9.5-01 interface service tcp 3389 3389

    translate_hits = 0, untranslate_hits = 2

3 (dmz) to (outside) source static obj-172.16.9.5-02 interface service tcp ldap ldap

    translate_hits = 0, untranslate_hits = 0

4 (dmz) to (outside) source static obj-172.16.9.5-03 interface service tcp ftp ftp

    translate_hits = 0, untranslate_hits = 0

5 (dmz) to (outside) source static obj-172.16.9.5-04 interface service tcp smtp smtp

    translate_hits = 0, untranslate_hits = 267

6 (dmz) to (inside) source static obj-172.16.9.0 172.16.9.0

    translate_hits = 4070, untranslate_hits = 224

7 (inside) to (dmz) source static obj-10.1.0.0 10.1.0.0

    translate_hits = 0, untranslate_hits = 0

8 (inside) to (dmz) source static obj-172.16.0.0 172.16.0.0

    translate_hits = 152, untranslate_hits = 4082

9 (dmz) to (outside) source dynamic obj-172.16.9.0-01 interface

    translate_hits = 69, untranslate_hits = 0

10 (inside) to (outside) source dynamic obj_any interface

    translate_hits = 196, untranslate_hits = 32

2 Accepted Solutions

Accepted Solutions

Yudong Wu
Level 7
Level 7

I think you need the following two NAT config

nat (inside,outside) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-192.168.100.0 obj-192.168.100.0
nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0

Please configure them and remove any extra NAT configuration, and then try it again.

View solution in original post

Hi,

Have you tried removing the "unidirectional" keywords in line 2 and line 4? That is, the 2 commands should look like below:

nat (inside,outside) source static obj-172.16.1.0 obj-172.16.1.0  destination static obj-192.168.100.0 obj-192.168.100.0

nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0  destination static obj-192.168.100.0 obj-192.168.100.0

Hope this helps. Try this out and let me know if it works.

Regards,

Prapanch

View solution in original post

8 Replies 8

Yudong Wu
Level 7
Level 7

I think you need the following two NAT config

nat (inside,outside) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-192.168.100.0 obj-192.168.100.0
nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0

Please configure them and remove any extra NAT configuration, and then try it again.

I already had line four as you suggested but modified line two and still no go. Any other recommendations?

nat (inside,any) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional
nat (inside,outside) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional
nat (inside,any) source static obj-172.16.1.0 obj-172.16.1.0 destination static obj-172.16.12.0 obj-172.16.12.0 unidirectional
nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-192.168.100.0 obj-192.168.100.0 unidirectional
nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0 destination static obj-172.16.12.0 obj-172.16.12.0 unidirectional
!
object network obj-172.16.0.0
nat (inside,dmz) static 172.16.0.0
object network obj-10.1.0.0
nat (inside,dmz) static 10.1.0.0
object network obj_any
nat (inside,outside) dynamic interface
object network obj-172.16.9.0
nat (dmz,inside) static 172.16.9.0
object network obj-172.16.9.5
nat (dmz,outside) static interface service tcp www www
object network obj-172.16.9.5-01
nat (dmz,outside) static interface service tcp 3389 3389
object network obj-172.16.9.5-02
nat (dmz,outside) static interface service tcp ldap ldap
object network obj-172.16.9.5-03
nat (dmz,outside) static interface service tcp ftp ftp
object network obj-172.16.9.5-04
nat (dmz,outside) static interface service tcp smtp smtp
object network obj-172.16.9.0-01
nat (dmz,outside) dynamic interface
access-group OUT_IN in interface outside
access-group DMZ in interface dmz

Hi,

Have you tried removing the "unidirectional" keywords in line 2 and line 4? That is, the 2 commands should look like below:

nat (inside,outside) source static obj-172.16.1.0 obj-172.16.1.0  destination static obj-192.168.100.0 obj-192.168.100.0

nat (dmz,outside) source static obj-172.16.9.0 obj-172.16.9.0  destination static obj-192.168.100.0 obj-192.168.100.0

Hope this helps. Try this out and let me know if it works.

Regards,

Prapanch

That did the trick. What does the unidirectional statement at the end imply, only one direction? What would someone use that for.

Yes that's exactly what it means. Just in one direction. Well i am not aware of exact scenarios but i am sure some do exist. But as the document you referred to explains,  the reason why the migration to 8.3(2) adds it automatically is due to a previously known bug. Anyway great that it worked.

Thanks and Regards,

Prapanch

So, you did not see the difference between the NAT commands which I suggested and your existing NAT commands.

Somehow that one went right by me :-) but yes, your orginal response would also appear to be correct. It was late when I tried it so I probably forgot to remove the unidirectional portion I also have marked your reponse a correct.

Jay Johnston
Cisco Employee
Cisco Employee

The connectivity is failing due to the 'unidirectional' keyword that was added as a part of the migration to 8.3(2).

This is bug

CSCti36048    ASA upgrade to 8.3(2) adds unidirectional keyword to manual nat lines

I'll modify the document you read (https://supportforums.cisco.com/docs/DOC-12569) so that it makes this bug more obvious.

- Jay

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: