topic basic nat not working in Network Security

basic nat not working

Alex Mendez — Mon, 11 Mar 2019 23:12:03 GMT

I am trying to set up a basic configuration and cant figure out why nat is not working.

my outside vlan 2 ping public ip address

my inside vlan 1 does not ping anything public ,

i have

nat (inside) 1 192.168.1.0 255.255.255.0

global (outside) 1 interface

not sure why it does not work. do I need acls?

Pleaes see my config attached

basic nat not working

Jennifer Halim — Sat, 26 May 2012 04:20:12 GMT

Please add inspect icmp:

policy-map global_policy

class inspection_default

inspect icmp

basic nat not working

Alex Mendez — Sat, 26 May 2012 04:31:39 GMT

Hi Jennifer thank you

my that did not fix my issue. I can ping my inside hosts from the ASA without specifying an interface and I can ping public ip addresses without specifying an interface

It appears my internal hosts cant reach the internet , if i try to ping 208.67.222.222( public dns) from my internal host 192.168.1.20,( server,) i get no response.

any ideas?

basic nat not working

Julio Carvajal — Sat, 26 May 2012 04:36:27 GMT

Hello Alex,

Can you provide us the Ipconfig from your PC.

As Jennifer stated you were missing the ICMP stateful inspection, now that you have it you should be able to ping it.

Also provide us the following:

packet-tracer input inside icmp 192.168.1.20 8 0 4.2.2.2

Also add the following capture

capture asp type asp-drop all

Then try to ping from your PC to 4.2.2.2 and finally provide us the output of :

show capture asp | include 4.2.2.2

Regards,

Julio

Security Engineer

Do rate all the helpful posts

basic nat not working

Alex Mendez — Sat, 26 May 2012 13:32:55 GMT

Hi Julio ,t hanks for responding, attached is my packet-tracert configuration

packet tracert output

packet-tracer input inside icmp 192.168.1.20 8 0 4.2.2$

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

MAC Access list

Phase: 2

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

Additional Information:

Phase: 6

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Phase: 7

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (inside) 1 192.168.1.0 255.255.255.0

match ip inside 192.168.1.0 255.255.255.0 outside any

dynamic translation to pool 1 ( [Interface PAT])

translate_hits = 1, untranslate_hits = 0

Additional Information:

Dynamic translate 192.168.1.20/0 to /4 using netmask 255.255.255.255

Phase: 8

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 1 192.168.1.0 255.255.255.0

match ip inside 192.168.1.0 255.255.255.0 inside any

dynamic translation to pool 1 (No matching global)

translate_hits = 0, untranslate_hits = 0

Additional Information:

( is this the issue here?)

Phase: 9

Type: HOST-LIMIT

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 10

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 11

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 71, packet dispatched to next module

Phase: 12

Type: ROUTE-LOOKUP

Subtype: output and adjacency

Result: ALLOW

Config:

Additional Information:

found next-hop using egress ifc outside

adjacency Active

next-hop mac address 0026.f324.ba24 hits 294

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

basic nat not working

Alex Mendez — Sat, 26 May 2012 13:47:32 GMT

Here is my show nat

show nat

NAT policies on Interface inside:

match ip inside 192.168.1.0 255.255.255.0 inside any

dynamic translation to pool 1 (No matching global)

translate_hits = 0, untranslate_hits = 0

match ip inside 192.168.1.0 255.255.255.0 outside any

dynamic translation to pool 1 ( [Interface PAT])

translate_hits = 1, untranslate_hits = 0

match ip inside 192.168.1.0 255.255.255.0 _internal_loopback any

dynamic translation to pool 1 (No matching global)

translate_hits = 0, untranslate_hits = 0

basic nat not working

Alex Mendez — Sat, 26 May 2012 13:58:57 GMT

THe ipconfig on my linux server is

192.168.1.20

255.255.255.0

192.168.1.1 (cisco asa)

dns 208.67.222.222

basic nat not working

Julio Carvajal — Sat, 26 May 2012 21:37:51 GMT

Hello Alex,

As you marked on the packet tracer that is the issue, there is no translation for those packets..

You are running a very old version but I have not see any bugs related to the ASA to apply the proper translation when the protocol its ICMP...

Is it possible that you could do a hard reload, if this does not solve it I will look into our database for a bug or something related to this odd behavior,

Regards,

Julio

Rate all the helpful posts

basic nat not working

Alex Mendez — Fri, 01 Jun 2012 17:12:37 GMT

Hi All - thanks for responding, i fixed the issue by upgrading to asa843. I then configured nat with the following an d poof! it worke.

object network obj-

nat (inside,outside) dynamic interface

Thanks

basic nat not working

Julio Carvajal — Fri, 01 Jun 2012 17:22:51 GMT

Hello Alex,

Thanks for letting us know the solution

Please mark the question as answered so future users can learn from the same issue you had.

Regards,

Julio

basic nat not working

Alex Mendez — Fri, 01 Jun 2012 18:00:06 GMT

Thanks Julio - i do need help with acl issue, if you can take a look at that, i would appreciat it. Its a new thread,

basic nat not working

ccnpjobhunter — Fri, 01 Jun 2012 20:15:57 GMT

Upgrade the asdm image too.