NATing "Reverse Path Failure" problem - help required

Cormac Champion — Thu, 12 Sep 2019 21:15:26 GMT

Hi all,

I'm new to ASA's and I have a NATing issue which I'm unable to resolve. I'm trying to allow external access through my ASA to a Web Server.

I've used the Packet Tracer in the ASDM and it's recording the following in the Monitoring log

Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src MY-ISP:xx.xx.xx.xx/1065 dst INSIDE:10.10.10.101/443 denied due to NAT reverse path failure

The NAT Rule I have added is as follows

nat (INSIDE,MY-ISP) source static obj-Web_Server interface service any REMOTE-HTTPS

Where

object network obj-WEB_Server
host 10.10.10.101

object service REMOTE-HTTPS
service tcp source eq https

My ISP Connection is presented as 192.168.1.17. The ISP forwards all ports from their router to mine. I have a 0.0.0.0 0.0.0.0 via 192.168.1.1 for my ISP connection

From what I have read, it seems I need to add a NoNat ACL somewhere, but with the ASDM, I'm not sure as to where this should be added, and in what form.

Re: NATing "Reverse Path Failure" problem - help required

bhargavdesai — Fri, 13 Sep 2019 02:27:06 GMT

You need service https https in the below statement.

nat (INSIDE,MY-ISP) source static obj-Web_Server interface service any REMOTE-HTTPS

And make sure you have configured ACL on the interface MY-ISP to allow access in for your web server.

HTH

topic Re: NATing "Reverse Path Failure" problem - help required in Network Security

NATing "Reverse Path Failure" problem - help required

Re: NATing "Reverse Path Failure" problem - help required