Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Policy Nat Asa 5520 ver 8.0(4)

Dear All,

I have configured my two asa5520 with: failover Acive/Active,

multiple context mode

All work fine except for the policy nat, I have configured it in this way:

access-list FRTEND2_TO_SHARED extended permit tcp host 192.168.233.69 any

static (front_end_d,outside) 50.70.60.19 access-list FRTEND2_TO_SHARED

I tested the policy nat:

packet-tracer input front_end_d tcp 192.168.233.69 25 50.70.60.13 25

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 50.70.60.0 255.255.255.192 outside

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: INSPECT

Subtype: inspect-smtp

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect esmtp _default_esmtp_map

service-policy global_policy global

Additional Information:

Phase: 5

Type: FOVER

Subtype: standby-update

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (front_end_d,outside) 50.70.60.19 access-list FRTEND2_TO_SHARED

nat-control

match tcp front_end_d host 192.168.233.69 outside any

static translation to 50.70.60.19/0

translate_hits = 0, untranslate_hits = 0

Additional Information:

Phase: 7

Type: NAT

Subtype:

Result: DROP

Config:

nat (front_end_d) 0 0.0.0.0 0.0.0.0

nat-control

match ip front_end_d any outside any

no translation group, implicit deny

policy_hits = 4

Additional Information:

Result:

input-interface: front_end_d

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

Why the phase 7 fails?If I use a static nat without policy nat it works fine.

Thanks and Regards,

Igor.

1 ACCEPTED SOLUTION

Accepted Solutions
Community Member

Re: Policy Nat Asa 5520 ver 8.0(4)

Can you try:

access-list FRTEND2_TO_SHARED extended permit ip host 192.168.233.69 any


If it was usefull to you, please rate. Thanks!

1 REPLY
Community Member

Re: Policy Nat Asa 5520 ver 8.0(4)

Can you try:

access-list FRTEND2_TO_SHARED extended permit ip host 192.168.233.69 any


If it was usefull to you, please rate. Thanks!

196
Views
0
Helpful
1
Replies
СоздатьДля создания публикации, пожалуйста в систему