topic Re: FMC Only 1 NAT rule working in Network Security

FMC Only 1 NAT rule working

s_SiD_s — Mon, 23 Mar 2026 10:14:04 GMT

Goog day!
FMC 7.6.5 (build 106)

NAT from local net working fine.
Need to NAT server from another vlan to another public IP, not on FTDv OUTSIDE interface ip.

on ASA5550 this works by

nat (inside,outside) source dynamic NAT-SOURCE-SRV NAT-PUB-SRV

I have made same on FMC
> show running-config nat
nat (INSIDE,OUTSIDE) source dynamic NAT-SOURCE-SRV NAT_PUBLIC_SRV

i see xlates to another public ip, also see connections.
but no interfnet on PC....ERR_CONNECTION_TIMED_OUT
no ping outside...

looks like I forgot something..somewhere...

Re: FMC Only 1 NAT line working

s_SiD_s — Mon, 23 Mar 2026 08:20:20 GMT

FTDv CLI, we see that NAT is going to be .60.40 that is the goal. IP add 60.126 it is ip of FTDv OUTSIDE interface.

But no internet.

packet-tracer shows all "as green and passed"

Re: FMC Only 1 NAT line working

Rob Ingram — Mon, 23 Mar 2026 08:43:45 GMT

@s_SiD_s I assume 10.201.213.249 is NAT-SOURCE-SRV? Is 60.40 in the same network as the outside IP address of the FTD - therefore the upstream router has a route back via the FTD?

Can you run packet tracer from the CLI and provide the full output (mask your public IP addresses) but provide the full output.

Re: FMC Only 1 NAT line working

s_SiD_s — Mon, 23 Mar 2026 08:59:16 GMT

I see now...

APR on border main GW shows

60.40 0026.0b31.64df (MAC is OUTSIDE int of ASA5550)
and 60.51 (ip add of OUTSIDE ASA5550) address ARP shows 0026.0b31.64df
that is why NAT 60.40 doesn't work on FTDv?
i have tried another IP, which is free 60.125 , but same result

Re: FMC Only 1 NAT line working

Rob Ingram — Mon, 23 Mar 2026 09:27:49 GMT

@s_SiD_s Is proxy arp disabled on that nat rule?

Run "show nat detail" and provide the output.

Re: FMC Only 1 NAT line working

s_SiD_s — Mon, 23 Mar 2026 10:13:01 GMT

> show nat detail Manual NAT Policies Implicit (Section 0) 1 (nlp_int_tap) to (INSIDE) source static nlp_server__snmp_32_10.201.213.11_intf3 interface destination static 0_10.201.213.11_2 0_10.201.213.11_2 service udp snmp snmp translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: 10.201.98.101/29 Destination - Origin: 10.201.213.11/32, Translated: 10.201.213.11/32 Service - Protocol: udp Real: snmp Mapped: snmp 2 (nlp_int_tap) to (OUTSIDE) source static nlp_server__ssh_10.129.0.0_intf2 interface destination static 0_10.129.0.0_3 0_10.129.0.0_3 service tcp ssh ssh translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: xx.xx.60.126/25 Destination - Origin: 10.129.0.0/16, Translated: 10.129.0.0/16 Service - Protocol: tcp Real: ssh Mapped: ssh 3 (nlp_int_tap) to (INSIDE) source static nlp_server__ssh_10.129.0.0_intf3 interface destination static 0_10.129.0.0_5 0_10.129.0.0_5 service tcp ssh ssh translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: 10.201.98.101/29 Destination - Origin: 10.129.0.0/16, Translated: 10.129.0.0/16 Service - Protocol: tcp Real: ssh Mapped: ssh 4 (nlp_int_tap) to (INSIDE) source static nlp_server__ssh_10.201.64.0_intf3 interface destination static 0_10.201.64.0_4 0_10.201.64.0_4 service tcp ssh ssh translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: 10.201.98.101/29 Destination - Origin: 10.201.64.0/24, Translated: 10.201.64.0/24 Service - Protocol: tcp Real: ssh Mapped: ssh 5 (nlp_int_tap) to (OUTSIDE) source dynamic nlp_client_0_10.129.0.0_6proto22_intf2 interface destination static nlp_client_0_ipv4_2 nlp_client_0_ipv4_2 service nlp_client_0_6svc22_1 nlp_client_0_6svc22_1 translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: xx.xx.60.126/25 Destination - Origin: 10.129.0.0/16, Translated: 10.129.0.0/16 Service - Origin: tcp destination eq ssh , Translated: tcp destination eq ssh 6 (nlp_int_tap) to (INSIDE) source dynamic nlp_client_0_10.129.0.0_6proto22_intf3 interface destination static nlp_client_0_ipv4_6 nlp_client_0_ipv4_6 service nlp_client_0_6svc22_5 nlp_client_0_6svc22_5 translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: 10.201.98.101/29 Destination - Origin: 10.129.0.0/16, Translated: 10.129.0.0/16 Service - Origin: tcp destination eq ssh , Translated: tcp destination eq ssh 7 (nlp_int_tap) to (INSIDE) source dynamic nlp_client_0_10.201.64.0_6proto22_intf3 interface destination static nlp_client_0_ipv4_4 nlp_client_0_ipv4_4 service nlp_client_0_6svc22_3 nlp_client_0_6svc22_3 translate_hits = 0, untranslate_hits = 0 Source - Origin: 169.254.1.2/32, Translated: 10.201.98.101/29 Destination - Origin: 10.201.64.0/24, Translated: 10.201.64.0/24 Service - Origin: tcp destination eq ssh , Translated: tcp destination eq ssh Manual NAT Policies (Section 1) 1 (INSIDE) to (OUTSIDE) source dynamic VLAN_213 NAT_125 dns translate_hits = 371, untranslate_hits = 0 Source - Origin: 10.201.213.0/24, Translated: xx.xx.60.125/32 Auto NAT Policies (Section 2) 1 (INSIDE) to (OUTSIDE) source dynamic SPB_BELL_NETWORK interface translate_hits = 0, untranslate_hits = 0 Source - Origin: 10.206.64.0/24, Translated: xx.xx.60.126/25 2 (INSIDE) to (OUTSIDE) source dynamic NAT_BELL_NETWORK interface translate_hits = 90770, untranslate_hits = 10777 Source - Origin: 10.201.0.0/16, Translated: xx.xx.60.126/25 > > >

Proxy ARP is grayed out on that NAT rule

Re: FMC Only 1 NAT rule working

s_SiD_s — Mon, 23 Mar 2026 10:55:05 GMT

i see couple of topics, same issue I have.

https://community.cisco.com/t5/routing-and-sd-wan/fmc-ftd-autonat-to-public-ip-addrees-instead-of-destiantion/td-p/5075343

https://community.cisco.com/t5/network-security/ftd-isn-t-able-to-nat-multiple-ips/td-p/4490975

Re: FMC Only 1 NAT rule working

s_SiD_s — Mon, 23 Mar 2026 12:18:39 GMT

packet capture/
no reply ...

> capture CAPI trace interface INSIDE match ip host 10.201.213.249 host 77.88.8.8 > capture CAPO interface OUTSIDE match ip any host 77.88.8.8 > > show capture CAPI 1: 12:08:46.342755 10.201.213.249 > 77.88.8.8 icmp: echo request 2: 12:08:51.339582 10.201.213.249 > 77.88.8.8 icmp: echo request 3: 12:08:56.343106 10.201.213.249 > 77.88.8.8 icmp: echo request 4: 12:09:01.340726 10.201.213.249 > 77.88.8.8 icmp: echo request 5: 12:09:06.341031 10.201.213.249 > 77.88.8.8 icmp: echo request 6: 12:09:11.345593 10.201.213.249 > 77.88.8.8 icmp: echo request > > show capture CAPO 1: 12:08:56.343457 xx.xx.60.125 > 77.88.8.8 icmp: echo request 2: 12:09:01.341062 xx.xx.60.125 > 77.88.8.8 icmp: echo request 3: 12:09:06.341397 xx.xx.60.125 > 77.88.8.8 icmp: echo request 4: 12:09:11.346005 xx.xx.60.125 > 77.88.8.8 icmp: echo request 5: 12:09:16.352246 xx.xx.60.125 > 77.88.8.8 icmp: echo request 6: 12:09:21.355480 xx.xx.60.125 > 77.88.8.8 icmp: echo request > no capture /all

Re: FMC Only 1 NAT rule working

Marvin Rhoads — Mon, 23 Mar 2026 16:36:39 GMT

Is your outside network a /24? Just asking to confirm that the various addresses you have tested are indeed in the same subnet.

Re: FMC Only 1 NAT rule working

s_SiD_s — Mon, 23 Mar 2026 17:27:11 GMT

public network /25

I think proxy arp does not working at all on FMC\FTDv
I have added static route to Border GW - xx.xxx60.125 255.255.255.255 xx.xx.60.126

poiting that .125 in behind OUTSIDE int of FTDv

now, NAT with .125 working as per config.
it is odd...

Re: FMC Only 1 NAT rule working

Marvin Rhoads — Tue, 24 Mar 2026 02:23:55 GMT

Check your running config for potentially hidden sysopt proxyarp commands:

show running-config all | include sysopt

Re: FMC Only 1 NAT rule working

s_SiD_s — Tue, 24 Mar 2026 07:02:43 GMT

there was:
sysopt noproxyarp OUTSIDE
sysopt noproxyarp INSIDE
sysopt noproxyarp management

so I have made a Flexconfig to disable it.
then removed the route and NAT starts to work.
Someone switched off same setting on ASA5550, that's why same config works on asa.

And it is strange, that settings in NAT does not work, untill proxyarp globally disabled.

Re: FMC Only 1 NAT rule working

s_SiD_s — Tue, 24 Mar 2026 09:28:51 GMT

yeap)
after that, i see a lot of tries or sniff high tcp port on ip .60.125 )
how to stop this nightmare?