04-30-2007 10:44 AM - edited 03-11-2019 03:07 AM
Hi all -
Had an interesting problem today, and I was wondering if someone might be able to explain to me what could have been happening.
I had this user that couldn't connect to the internet. After some snooping around, I noticed that the firewall wasn't building an xlate entry for her. Internally, routing seemed fine, because I could ping her device from our firewall and vice versa, and she was able to communicate to all internal services but nothing past our firewall. Her ip is assigned by dhcp and her PAT address falls under the Nat (1) 0.0.0.0 0.0.0.0 entry and matched to the global (1) address. Also looking at the Xlate table, there were over 100 entries for others in the same subnet she was in.
To resolve it, I switched to manual IP configuration, and switched it back to DHCP and it obtained a different IP address that the previous one and it worked fine.
So I guess my question is, what would prevent the firewall from building a dynamic translation from a specific private ip address.
Thanks for all the help.
04-30-2007 10:15 PM
hello ryan,
the only reason why a dynamic translation might be affected, is if the same IP has a static or a nonat , before the global NAT entry !!! Is the PC a part of Layer 2 on the inside interface ? i mean is the def gateway of the PC , the firewall ? I hope there arent any issues with ARP !! did u check if there are any software bugs related to your IOS ??
Raj
05-01-2007 07:54 AM
Raj -
Thanks for your response. I thought the same thing about either a bad no-nat entry or a static entry, but this particular ip had neither as part of the pix config. The inside network is a mix of L2 and L3 devices, but the actual gateway of the PC is a vlan interface on a 6509 L3 switch.
It might be an issue with arp, but wouldn't that problem effect pings as well. ICMP and Traceroute to and from the end PC worked fine, traffic just couldn't traverse the PIX because it wasn't building that translation.
I will have to check to see if there is a bug, and if not, hope this problem doesn't pop up again.
Thanks again.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide