Auto NAT and outside pool ip address

[mahesh18]

Hi Everyone,

If i do Auto NAT  from DMZ  interface to outside  interface using config below

object network Auto_NAT

subnet 192.168.70.0 255.255.255.0                           *********************DMZ  subnet

description Auto NAT  DMZ Interface

object network Outside_pool

range 192.168.51.3 192.168.51.100

object network Auto_NAT

nat (DMZ,outside) dynamic Outside_pool

My outside interface has IP  of 192.168.71.2

I am unable to access the internet using above config 

when i change the range in outside_pool  to 192.168.71.3 192.168.71.100  i am able to access the internet.

Does this mean that using auto nat using dynamic NAT  the outside pool range should be in same subnet as outside interface  ip address?

Regards

MAhesh

[Jouni Forss · Accepted solution]

Hi Mahesh,

The NAT Pool doesnt have to be the same network as the "outside" interfaces network.

But in that case you have to make sure that the router infront of the ASA knows about this NAT Pool network.

The router either needs

• A route for the network used as the NAT Pool pointing towards the current "outside" interface IP address of the ASA
• OR the router interface facing ASA needs an "secondary" address configured in the network that includes the NAT Pool used
  • In this case you also need the command "arp permit-nonconnected" enabled on the ASA

- Jouni

[mahesh18]

Hi Julio,

Something new learn today .

I will test that tomorrow.

Best regards

MAhesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

No it does not,

That behavior let us know that there is an ARP issue with those IP addresses,

Does the ISP side know that you have that range of IP addresses 192.168.51.x.

Also what version are you running as Proxy-ARP is disabled in some versions (8.4.3 and 8.6 if I am not wrong ) so the ASA will not proxy-arp for IP addresses not connected or on the same subnet than the ASA.

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Hi Julio,

IOS  is

Cisco Adaptive Security Appliance Software Version 9.1(1)

Device Manager Version 7.1(2)

I will test it tomorrow after work

Regards

MAhesh

[Julio Carvajal · Accepted solution]

Hello,

The command that jounni recommend (arp permit non-connected) is available on that version

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Hi jouni,

I config the Outside pool ip which was not from the outside interface of ASA.

Also on Switch which has direct connection to ASA outside interface ip i config command

3550SMIA(config)#ip route 192.168.72.0 255.255.255.0 192.168.71.2

where 192.168.71.2 is ASA outside interface ip.

Now i can not access the internet.

ciscoasa# sh xlate

1 in use, 3 most used

Flags: D - DNS, e - extended, I - identity, i - dynamic, r - portmap,

       s - static, T - twice, N - net-to-net

NAT from DMZ:192.168.70.3 to outside:192.168.72.56 flags i idle 0:00:00 timeout 3:00:00

Regards

Mahesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

The configuration on the ASA should remain the same.

On the Upstream device it should be:

no ip route 192.168.72.0 255.255.255.0 192.168.71.2

ip route 192.168.51.0 255.255.255.0 192.168.71.2

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Hi Julio,

I change the outside_pool ip to subnet 192.168.72.0

object network Auto_NAT_DMZ

subnet 192.168.70.0 255.255.255.0

description Auto NAT  DMZ Interface

object network Outside_pool

range 192.168.72.3 192.168.72.100

Regards

MAhesh

[Julio Carvajal]

Hello Mahesh,

Okey.

And what happens, same thing?

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Yea samething no internet from pc

but from asa i can ping internet

[Julio Carvajal · Accepted solution]

Hello Mahesh,

Okey,

Please share both the config from L3 switch and ASA at the moment,

I will need to analize the configuration

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Hi Julio,

Here is log from ASA

Aug 15 2013 22:09:08: %ASA-6-302014: Teardown TCP connection 8398 for DMZ:192.168.70.3/5703 to identity:192.168.70.1/443 duration 0:00:00 bytes 3619 TCP Reset-O

Aug 15 2013 22:09:08: %ASA-6-106015: Deny TCP (no connection) from 192.168.70.3/5703 to 192.168.70.1/443 flags FIN ACK  on interface D

Config is attached with original post.

Regards

Mahesh

[Julio Carvajal · Accepted solution]

Hello,

Looks like we are receiving a Reset pacekt from the device on the lower security level.

The Deny TCP no connection could mean 2 things

1)Asymetric routing

2) Server is sending information after the connection was released on the ASA

Check my blog at http:laguiadelnetworking.com for further information.

Cheers,

Julio Carvajal Segura

[mahesh18]

Hi Julio,

As per this message seems its natting issue

Aug 15 2013 22:11:59: %ASA-6-110003: Routing failed to locate next hop for TCP from identity:192.168.70.1/443 to DMZ:192.168.70.3/5712

where 70.3  is pc ip

70.1  is DMZ  interface

Regards

mahesh