Changing priority of Static NAT over NAT exempt rule

jon.seung@applecaremedical.com — Fri, 21 Feb 2020 14:45:41 GMT

Hello,

Suppose we have two NAT rules under 'NAT Rules';

# Type Original (Source) Original (Destination) Interface (Translated) Address(Translated)

1 Exempt ANY ANY Outbound
2 Static Web_internal ANY Outside (Web_external)

Firewall accept inbound access to the external IP address (Statically NATed) of Web_external however I'm seeing asymmetric routing issue on ASA log.

Asymmetric NAT rules matched for forward and reverse flows- denied due to NAT reverse path failure.

I see NAT exemption rule (#1) is overwritting statc NAT for the outbound.
Is there any way we could put the highest priority on Static NAT over NAT exemption rule?

There is up/down arrow for both NAT exemption and static rule but static rule can not go above the NAT exemption rule.

Re: Changing priority of Static NAT over NAT exempt rule

Francesco Molino — Thu, 16 Nov 2017 03:55:48 GMT

Hi

Here an explain on how may is processed on asa:
https://supportforums.cisco.com/t5/security-documents/asa-nat-8-3-nat-operation-and-configuration-format-cli/ta-p/3143050

Can you share your config and give us the source ip and destination ip? With that information we'll be able to help you.

topic Re: Changing priority of Static NAT over NAT exempt rule in Network Security

Changing priority of Static NAT over NAT exempt rule

Re: Changing priority of Static NAT over NAT exempt rule