Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

ASA 9.1.2 packet tracer

Hello,

I'm working on ASA migration from 8.2.5 to 9.1.2. When I try packet trace for static nat testing purpose from ASDM the destination address is not populated by nat ip but the real one. That happen only on a specific interface which is full of nat (and where I also have some "identity nat"). Can someone tell me why ? is it a normal behaviour ?

Thank you

4 REPLIES
Super Bronze

ASA 9.1.2 packet tracer

Hi,

I am not really sure what you mean.

Can you perhaps use the "packet-tracer" through the CLI and show what happens. Naturally you can also share a screencapture from the ASDMs packet tracer if you dont use CLI at all

- Jouni

ASA 9.1.2 packet tracer

Not entirely sure about what you are talking about but just in case.

Remember that the behavior on ASA firewall changes dramatically from ASA 8.2 and lower against 8.3. and higher.

-In 8.2 and before the ASA firewall perform the ACL check and then the NAT rule (This is why you pointed to public Addresses on ACL)

-In 8.3 and higher the ASA performs NAT rules first and then ACL check (This is why u now point to private IP address in ACL)

This does not mean that if running packet-tracer u must use the private IP address if comming for the internet. So make sure u still use the public IP address of the server u are trying to acces.

Hope that I could help!

Looking for some Networking Assistance? 
Contact me directly at jcarvaja@laguiadelnetworking.com

I will fix your problem ASAP.

Cheers,

Julio Carvajal Segura
http://laguiadelnetworking.com

Julio Carvajal
Senior Network Security and Core Specialist
CCIE #42930, 2xCCNP, JNCIP-SEC
Community Member

ASA 9.1.2 packet tracer

Thanks for your reply Jouni. Packet-tracer through the CLI is ok, of course also packet-tracer through ASDM is ok if I insert nat ip on destination ip field. The issue is precisely that from an access rule (which involves nat) by clicking on packet tracer the destination ip should'nt be filled with the real ip (as it is on the access rule) but the nat ip.

Community Member

ASA 9.1.2 packet tracer

That happen because og identity nat.

569
Views
0
Helpful
4
Replies
CreatePlease to create content