Strange after-auto nat behaviour when using "any" as source

Chess Norris — Mon, 14 Jun 2021 13:23:53 GMT

Hi,

I was working on an issue a customer of mine had with NAT. The customer decided to tunnel all remote VPN and have the traffic u-turn on the outside interface. I created a nat (outside,outside) rule for this like I've done many times before for customers that want this feature. However, the VPN users couldn't reach Internet after we enabled the tunnel all policy. After some troubleshooting with packet-tracer, I saw that the following nat rule was hit at the end on phase 9 and caused the issue -

nat (any,outside) after-auto source dynamic any interface. The output from packet-tracer looked like this

Phase: 9
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
nat (any,outside) after-auto source dynamic any interface

The solution was to either change (any,outside) to specific source interfaces or to change the source to something else than any, like nat (any,outside) after-auto source dynamic RFC1918 interface

After changing to the above nat rule, the packet-tracer still hit the after-auto rule, but this time it's allowed.

Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (any,outside) after-auto source dynamic RFC1918 interface

Anyone have an idea on why this happen? Does the "any" perhaps match on both ingress and egress traffic?

Thanks

/Chess

topic Strange after-auto nat behaviour when using "any" as source in Network Security

Strange after-auto nat behaviour when using "any" as source