topic Re: NAT problems in Network Security

NAT problems

denilson.mota — Tue, 10 Dec 2019 09:26:29 GMT

Hello experts,

I have two ASA 5545X active-standby and I have an objtect-group natted to the outside interface, inside of the object-group I have one host, for sometime the host able to browse to the internet but now not working. The trace from the remote PC is finish on the FW. I have the acces-list allowing that object-group to any IP.

Anyone please help to figure out what can be happen and why this host can't browse to internet?

Many thanks,

Re: NAT problems

Jaderson Pessoa — Tue, 10 Dec 2019 11:03:56 GMT

Hello,

Could you share the asa configuration?

Re: NAT problems

denilson.mota — Tue, 10 Dec 2019 12:27:30 GMT

Hello Jaderson,

Find the configuration details on the attached picture:

I made a trace route from the host pc and the last hope is the FW interface

Re: NAT problems

Jaderson Pessoa — Tue, 10 Dec 2019 13:08:30 GMT

well, i think that your nat configurations is wront

try it:

object-group network OBJ-G
network-object host 1.1.1.1
network-object host 2.2.2.2
network-object 192.168.0.0 255.255.255.0
nat (inside,outside) source dynamic OBJ-G interface

Re: NAT problems

denilson.mota — Tue, 10 Dec 2019 13:35:19 GMT

First I have this NAT:

nat (Customs,Outside) source static RemoteGroup_Internet-Access interface

Then I remove and I create this NAT:

nat (Customs,Outside) source dynamic RemoteGroup_Internet-Access interface

The Customs interface is the interface where the host and remote group are configured, and still not working.

Re: NAT problems

gerald.scott — Tue, 10 Dec 2019 18:11:27 GMT

I would suggest running a Packet Tracer from the Firewall to see if it is actually blocking the traffic and why.

Re: NAT problems

Jaderson Pessoa — Wed, 11 Dec 2019 11:58:34 GMT

Well,

try it:
1. Check packet tracert in the firewall.
2. Check if end device can resolve name (ping 8.8.8.8) or (ping www.google.com) for exemple;
3. Check if this "RemoteGroup_Internet-Access" has your end device.

Regards

Re: NAT problems

denilson.mota — Wed, 11 Dec 2019 13:04:01 GMT

Find attached the output for all tests. The result of packet tracer is allowed and no block.

The end host is inserted into the object-group

The object have NAT and ACL permited

Re: NAT problems

Jaderson Pessoa — Wed, 11 Dec 2019 13:50:33 GMT

Well,

Could you share a simple draw of your topology? This firewall working as your routing to others networks or is there a L3?

Is there any other NAT configuration to this address?

Re: NAT problems

denilson.mota — Wed, 11 Dec 2019 15:22:38 GMT

Hello Jaderson,

Thank you for your attention on my case, find the draft of mine topology for your reference.

Re: NAT problems

denilson.mota — Wed, 11 Dec 2019 15:34:31 GMT

Please also see if the below info is normal behavior when we create a NAT

Re: NAT problems

Jaderson Pessoa — Wed, 11 Dec 2019 16:39:52 GMT

No, this showing to us that already exist something with this address. Found what is: Maputo_Mcnet_APN and acl number 208.

Re: NAT problems

denilson.mota — Wed, 11 Dec 2019 17:54:11 GMT

Maputo_Mcnet_APN is the host pc that want to browse and the acl 208 is the Nat I have created from the host pc to outside interface. I removed the old Nat from the object-group and I create this one to specific host but the host pc still not browsing.