topic asa 9.3.1 - issue - nat - single real ip and 2 mapped ip in Network Security

asa 9.3.1 - issue - nat - single real ip and 2 mapped ip

Eby Mani — Tue, 12 Mar 2019 05:09:55 GMT

I'm having a strange issue with ASA 9.3.1 on 5515-X.

A vpn device is connected inside LAN and is natted to 2 different public IPs. The problem is that when the primary isp fails and comes back, the remote side is unable to connect to the vpn device thru primary isp(unable to ping) all remaining nats work without any issue.

Traffic is permitted for VPN device in ACLs for ISP_1, ISP_2 interfaces and inside_access_in

Apart from this tracking is enabled for ISP_1 & ISP_2.

*****************************
object network VPN-LAN-Ip
host 172.16.200.270

object network VPN-Public-IP-ISP_1
host 10.200.250.10

object network VPN-Public-IP-ISP_1
host 192.200.250.10

nat (inside,isp_1) source static VPN-LAN-Ip VPN-Public-IP-ISP_1
nat (inside,isp_2) source static VPN-LAN-Ip VPN-Public-IP-ISP_2
*******************************

Am i missing something ?. i even tried creating second object name for use with isp_2 and used with nat.

Hi ,How is your vpn

Murali — Wed, 03 Dec 2014 05:37:37 GMT

Hi ,

How is your vpn configured what is the peer address for your remote client ?

Hi,VPN initiates site-to-site

Eby Mani — Thu, 04 Dec 2014 11:25:08 GMT

Hi,

VPN initiates site-to-site tunnel to the other end. Both ends private IP is mapped to the VPN box and only server traffic goes thru the tunnel.

NAT on ASA to the real ip works well when testing in lab setup, even with physically un/plugging the cable.

hi can you post your asa

Murali — Sat, 06 Dec 2014 19:04:25 GMT

hi can you post your asa config related to vpn setup , route configurations and nat config that is relevant.

I hope this link is helpful for you

https://supportforums.cisco.com/blog/150001/ipsec-vpn-redundancy-failover-over-redundant-isp-links

Thanks

Murali