topic Re: Xlate issues in Network Security

Xlate issues

ryan.bachman — Mon, 11 Mar 2019 10:07:02 GMT

Hi all -

Had an interesting problem today, and I was wondering if someone might be able to explain to me what could have been happening.

I had this user that couldn't connect to the internet. After some snooping around, I noticed that the firewall wasn't building an xlate entry for her. Internally, routing seemed fine, because I could ping her device from our firewall and vice versa, and she was able to communicate to all internal services but nothing past our firewall. Her ip is assigned by dhcp and her PAT address falls under the Nat (1) 0.0.0.0 0.0.0.0 entry and matched to the global (1) address. Also looking at the Xlate table, there were over 100 entries for others in the same subnet she was in.

To resolve it, I switched to manual IP configuration, and switched it back to DHCP and it obtained a different IP address that the previous one and it worked fine.

So I guess my question is, what would prevent the firewall from building a dynamic translation from a specific private ip address.

Thanks for all the help.

Re: Xlate issues

sachinraja — Tue, 01 May 2007 05:15:59 GMT

hello ryan,

the only reason why a dynamic translation might be affected, is if the same IP has a static or a nonat , before the global NAT entry !!! Is the PC a part of Layer 2 on the inside interface ? i mean is the def gateway of the PC , the firewall ? I hope there arent any issues with ARP !! did u check if there are any software bugs related to your IOS ??

Raj

Re: Xlate issues

ryan.bachman — Tue, 01 May 2007 14:54:04 GMT

Raj -

Thanks for your response. I thought the same thing about either a bad no-nat entry or a static entry, but this particular ip had neither as part of the pix config. The inside network is a mix of L2 and L3 devices, but the actual gateway of the PC is a vlan interface on a 6509 L3 switch.

It might be an issue with arp, but wouldn't that problem effect pings as well. ICMP and Traceroute to and from the end PC worked fine, traffic just couldn't traverse the PIX because it wasn't building that translation.

I will have to check to see if there is a bug, and if not, hope this problem doesn't pop up again.

Thanks again.