topic access-list Inside-Access-In in Network Security

Cisco ASA 5510 - denied due to NAT reverse path failure.

ketansoni1 — Tue, 12 Mar 2019 09:12:43 GMT

Hi All,

Would you be able to shed some light on the below error message? If you could look at the screenshot attached, it will show you the current setup. I have set this up using the ASDM, the packet is being denied when going from:

**Outside R1 to DMZ 192.168.. using TCP port 443 / 80**


%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse 
flows; Connection protocol src interface_name:source_address/source_port [(idfw_user)] dst interface_name:dst_address/dst_port [(idfw_user)] denied due to 
NAT reverse path failure.

An attempt to connect to a mapped host using its actual address was rejected.

The recommend action states:
When not on the same interface as the host using NAT, use the mapped address instead of the actual address to connect to the host. In addition, enable the inspect command if the application embeds the IP address.

Thanks

From what I can see on the

Marvin Rhoads — Wed, 12 Apr 2017 10:43:03 GMT

From what I can see on the screen shot, your NAT rule is referncing "any,outside" while the server resides in the DMZ.

The NAT rule would normally created referencing "dmz,outside".

Thank you for the quick reply

ketansoni1 — Wed, 12 Apr 2017 13:36:04 GMT

Thank you for the quick reply, unfortunately this did not work.

I have changed the server from being in the DMZ to Inside to no joy, whilst leaving the NAT rules as they were.

Also changed the NAT rules to dmz public to outside - with no joy, please see attached png

Hi,

Kornelia Gutierrez — Thu, 13 Apr 2017 01:10:35 GMT

Hi,

Could you please share a show run access-list of the acl that is placed in the outside and a show run nat?

Best regards,

access-list Inside-Access-In

ketansoni1 — Thu, 13 Apr 2017 08:02:48 GMT

access-list Inside-Access-In extended permit ip object WAPAY01_Payrol_Server any log

access-list Outside-R1-In extended permit object-group DM_INLINE_SERVICE_6 any object WAPAY01_Payrol_Server log

access-list DMZ-Public-In extended permit object-group DM_INLINE_SERVICE_3 object WAPAY01_Payrol_Server any log inactive (this is not in use)

NAT
object network WAPAY01_Payrol_Server
nat (Inside,Outside-R1) static 82.*.*.* ( I have taken out the public IP address)

Hope this helps, also please see screenshot

Is your WAPAY01 server on the

Marvin Rhoads — Fri, 14 Apr 2017 07:32:57 GMT

Is your WAPAY01 server on the inside or DMZ subnet? You mention both at various points. Is it multi-homed?

It is only on the inside

ketansoni1 — Tue, 18 Apr 2017 07:54:03 GMT

It is only on the inside interface. No longer sitting within the DMZ subnet