topic Re: FTD Nat Question in Network Security

FTD Nat Question

benolyndav — Tue, 14 Mar 2023 21:08:37 GMT

I Was recently looking into an issue with users unable to connect o an external site and I noticed that the translate hits for the nat rule associated with this access rule werent incrementing I disabled the rule and then re enabled and it sorted it users were able to get to the destination again and the nat translate counters were once again incrementing, Im now looking at another issue which involves another nat rule where users arent able to get to an external site and again the translate counters arent incrementing but the strange thing is 99% of users are getting to the site could this be some sort of bug.??

Thanks

Re: FTD Nat Question

Rob Ingram — Tue, 14 Mar 2023 21:15:52 GMT

@benolyndav hard to tell, do the users come from the same source network and therefore match the exact same rule?

Best thing to do is run packet-tracer from the CLI, this would confirm which NAT rule traffic is or is not matching - example "packet-tracer input INSIDE tcp 192.168.10.1 3000 8.8.8.8 80". It would also confirm if the problem is related to NAT and ACP issue or something else.

Re: FTD Nat Question

benolyndav — Tue, 14 Mar 2023 21:34:48 GMT

Hi
Yes I have ran the packet tracers and its stipulates the correct nat rule, the users that are having issues do tend to be sourced from the same network but the funny thing is not all users from this source subnet are having the issue.? Im wondering if its possible that some translations are stuck and not clearing automatically.?

Re: FTD Nat Question

Rob Ingram — Tue, 14 Mar 2023 21:41:13 GMT

@benolyndav nat exhaustion perhaps?

What version are you running, have you checked for bugs?

Re: FTD Nat Question

benolyndav — Tue, 14 Mar 2023 22:10:57 GMT

Version 7.01
I have had a look at the bugs and dont see anything relating to this, whats the best way to manually check for nat exhaustion ??

Thanks

Re: FTD Nat Question

MHM Cisco World — Wed, 15 Mar 2023 00:41:59 GMT

did your FTD connect to dual ISP ?

Re: FTD Nat Question

benolyndav — Wed, 15 Mar 2023 07:32:23 GMT

No single