We have created NAT from one interface of PIX to other with access-list permiting something interesting for NAT and everything works but UDP traffic from specific pool and from Cisco VPN client no. We dont see traffic on the other side of firewall. But when we ping to the same destination (from the same pool) like for VPN traffic, traffic flows perfectly and we see xlate in PIX. Only for UDP traffic and from specific pool (192.168.3.0)from Cisco VPN, PIX doesnt create NAT xlate.
nat (_inside_) 12 access-list NAT_to_VPN
global (outside) 12 x.x.x.x netmask 255.255.255.255
access-list NAT_to_VPN extended permit ip 192.168.2.0 255.255.254.0 10.123.0.0 255.255.0.0
All sessions that connect through the security appliance must undergo some form of network address translation, or NAT. Each NAT or NAT Overload (PAT) session is assigned a translation slot known as an xlate. These xlates can persist even after you make changes to the NAT rules that affect them. This can lead to a depletion of translation slots or unexpected behavior or both by traffic that undergoes translation.
Always clear xlates after you add, change, or remove the aaa-server, access-list, alias, global, nat, route, or static commands in your configuration.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...