topic Re: Asymmetric NAT rules matched for forwarda and reverse flows in Network Security

Asymmetric NAT rules matched for forwarda and reverse flows

kerryjcox — Mon, 11 Mar 2019 23:36:18 GMT

I am seeing the following error on my Cisco ASA 5510 running 8.4(4):

Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src inside:10.1.0.8/1798 dst inside:10.1.0.14/25 denied due to NAT reverse path failure

Doing research I see there are plenty of nonat statements regarding connecting from one interface to another, but why am I seeing this error on the same interface.

All our servers are connected via a Cisco 3750G switch with a very basic config. Why is the firewall interjecting itself and causing these issues?

Any suggestions would be most appreciated.

Kerry

Asymmetric NAT rules matched for forwarda and reverse flows

Vincenzo Errante — Mon, 30 Jul 2012 22:44:21 GMT

subnet mask mismatch?

Asymmetric NAT rules matched for forwarda and reverse flows

kerryjcox — Mon, 30 Jul 2012 23:07:26 GMT

No subnet mask mismatch, as far as I can tell.

Here is the "sho run": I have sanitized it as best I can.

ciscoasa# sho run

: Saved

ASA Version 8.4(4)

hostname ciscoasa

domain-name xxxxxx.com

enable password Gy7ZIY.vaWRxxxxx encrypted

passwd 2KFQnbNIdI.xxxxxx encrypted

names

interface Ethernet0/0

description === WAN Interface ===

speed 100

duplex full

nameif outside

security-level 0

ip address 216.38.xx.xx 255.255.255.240

interface Ethernet0/1

description === LAN Interface ===

nameif inside

security-level 100

ip address 10.1.0.1 255.255.255.0

interface Ethernet0/2

description === PNT to SLC ViaWest ===

speed 10

duplex full

nameif pnt

security-level 100

ip address 10.169.xx.xx 255.255.255.248

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

description === Management Interface ===

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

boot system disk0:/asa844-k8.bin

ftp mode passive

clock timezone MST -7

clock summer-time MDT recurring

dns domain-lookup outside

dns domain-lookup inside

dns domain-lookup management

dns server-group DefaultDNS

name-server 10.1.0.5

name-server 10.1.1.16

name-server 8.8.8.8

domain-name xxxxxxxx.com

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network 10.1.0.2

host 10.1.0.2

object network 10.1.0.22

host 10.1.0.22

object network 10.1.0.41

host 10.1.0.41

object network 10.1.0.86

host 10.1.0.86

object network bonecrusher.xxxxxx.local

host 10.1.0.12

description == bonecrusher internal ==

object network ccpwjb4bak001.xxxxxx.local

host 10.1.0.40

object network ccpwjb4bi001.xxxxxx.local

host 10.1.0.8

description == ccpwjb4bi001 internal ==

object network ccpwjb4db001.xxxxxx.local

host 10.1.0.10

description == bi database internal ==

object network ccpwjb4.xxxxxx.local

host 10.1.0.11

description == bi jasper internal ==

object network denver-viawest

subnet 10.1.0.0 255.255.255.0

description == Denver ViaWest Internal Network ==

object network cyberfrost.xxxxxx.local

host 10.1.0.5

description == cyberfrost internal ==

object network vwpwjb1bak001.xxxxxx.local

host 10.1.0.9

description == vwpwjb1bak001 internal ==

object network electrospark.xxxxxx.local

host 10.1.0.14

description == electrospark internal ==

object network NETWORK_OBJ_10.1.0.0_24

subnet 10.1.0.0 255.255.255.0

object network NETWORK_OBJ_10.10.0.0_20

subnet 10.10.0.0 255.255.240.0

object network slc-corp

subnet 10.10.0.0 255.255.240.0

description == slc corp internal network ==

object network slc-viawest

subnet 10.1.1.0 255.255.255.0

description == slc viawest internal network ==

object network NETWORK_OBJ_10.3.0.0_22

subnet 10.3.0.0 255.255.252.0

object network magnoquake.xxxxxx.local

host 10.1.0.13

description == magnoquake internal =

object network NETWORK_OBJ_192.168.100.0_24

subnet 192.168.100.0 255.255.255.0

object network denver-ops

subnet 10.3.0.0 255.255.252.0

description == denver ops internal network ==

object network denver-corp

subnet 192.168.100.0 255.255.255.0

description == denver corporate ==

object network brawl.xxxxxx.local

host 10.1.0.6

description == brawl internal ==

object network c3750-vw

host 10.1.0.200

description == cisco 3750 switch ==

object network 98.116.xx.xx

host 98.116.xx.xx

description FTP access

object-group service http-https tcp

description == tcp ports 80 and 443 ==

port-object eq www

port-object eq https

object-group service http-alternate tcp

description == tcp port 8080 ==

port-object eq 8080

object-group service DM_INLINE_TCP_1 tcp

group-object http-alternate

group-object http-https

object-group service talend-ports tcp

description == tcp ports 8000, 8001 and 8888 ==

port-object eq 8000

port-object eq 8001

port-object eq 8888

object-group service DM_INLINE_TCP_2 tcp

port-object eq ftp

port-object eq ftp-data

object-group service passive-ftp tcp

description == tcp ports 55000 to 60000 for passive ftp ==

port-object range 1024 65535

object-group service DM_INLINE_SERVICE_1

service-object gre

service-object tcp destination eq pptp

access-list outside_access_in remark == permit all http access to jasper server ==

access-list outside_access_in extended permit tcp any object ccpwjb4reports001.xxxxxx.local object-group DM_INLINE_TCP_1

access-list outside_access_in remark == permit all access to cyberfrost on port 1723 and gre ip protocol 47 ==

access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 any object cyberfrost.xxxxxx.local

access-list outside_access_in remark == permit all from denver corp full access to jasper server ==

access-list outside_access_in extended permit ip host 209.118.90.227 object ccpwjb4reports001.xxxxxx.local

access-list outside_access_in remark == permit all http access to magnoquake ==

access-list outside_access_in extended permit tcp any object magnoquake.xxxxxx.local object-group http-https

access-list outside_access_in remark == permit all http access to main xxxxxx website ==

access-list outside_access_in extended permit tcp any object electrospark.xxxxxx.local object-group http-https

access-list outside_access_in remark == permit all http access to main xxxxxx website ==

access-list outside_access_in extended permit tcp any object electrospark.xxxxxx.local object-group DM_INLINE_TCP_2

access-list outside_access_in extended permit ip object 98.116.172.191 object electrospark.xxxxxx.local

access-list outside_access_in remark == permit all ssh access to bi database ==

access-list outside_access_in extended permit tcp any object ccpwjb4db001.xxxxxx.local eq ssh

access-list outside_access_in remark == permit all from denver corp to bi4 ==

access-list outside_access_in extended permit ip host 209.118.90.227 object ccpwjb4bi001.xxxxxx.local

access-list outside_access_in remark == permit all ftp and ftp-data access to main xxxxxx web site ==

access-list outside_access_in extended permit udp any any eq domain

access-list outside_access_in remark == permit all ping packets ==

access-list outside_access_in extended permit icmp any any

access-list outside_access_in remark == catchall for logging ==

access-list outside_access_in extended deny ip any any

access-list outside_cryptomap extended permit ip 10.1.0.0 255.255.255.0 object slc-corp

access-list pnt_cryptomap extended permit ip object denver-viawest object slc-viawest

access-list outside_cryptomap_1 extended permit ip object denver-viawest object denver-ops

access-list outside_cryptomap_2 extended permit ip 10.1.0.0 255.255.255.0 object denver-corp

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu pnt 1500

mtu management 1500

ip verify reverse-path interface outside

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

icmp permit any inside

asdm image disk0:/asdm-649.bin

no asdm history enable

arp timeout 14400

nat (any,any) source static denver-viawest denver-viawest destination static denver-ops denver-ops description == nat denver viawest to denver ops ==

nat (any,any) source static denver-viawest denver-viawest destination static slc-viawest slc-viawest description == nat denver viawest to slc viawest == (pending)

nat (any,any) source static denver-viawest denver-viawest destination static denver-corp denver-corp description == nat denver viawest to denver corporate ==

nat (any,any) source static denver-viawest denver-viawest destination static slc-corp slc-corp description == nat denver viawest to slc corp ==

nat (inside,outside) source static denver-viawest denver-viawest destination static slc-corp slc-corp no-proxy-arp route-lookup

nat (inside,pnt) source static denver-viawest denver-viawest destination static slc-viawest slc-viawest no-proxy-arp route-lookup

nat (inside,outside) source static denver-viawest denver-viawest destination static denver-ops denver-ops no-proxy-arp route-lookup

nat (inside,outside) source static denver-viawest denver-viawest destination static denver-corp denver-corp no-proxy-arp route-lookup

nat (inside,outside) source static slc-viawest slc-viawest destination static denver-viawest denver-viawest no-proxy-arp route-lookup

nat (inside,outside) source dynamic denver-viawest interface description === nat internal network to outside gateway interface ===

object network bonecrusher.xxxxxx.local