topic ASA 8.4 nat issue in Network Security

ASA 8.4 nat issue

ntarnagada — Mon, 11 Mar 2019 20:13:53 GMT

Hello,

I'm currently using ASA 5510 with software 8.4.1 and I have an issue with nat configuration. I used the following config line:

nat (inside, dmz) source dynamic LAN Pat1 destination Server1 Server1

The traffic is not flowing and when I use Packet Tracer, packets are dropped at the NAT rule with the following error:

Drop-reason: (acl-drop) Flow is denied by configured rule

The only ACE I have is permit ip any any.

Thank you for help.

astripat — Mon, 28 Mar 2011 19:59:57 GMT

Hi,

What do we want to accomplish? Also, send me the following:

Sh run object id LAN

Sh run object id Pat1

Sh run object id Server1

Regards,

Ashu

Shrikant Sundaresh — Tue, 29 Mar 2011 13:06:24 GMT

Hey,

So this error you are facing is mainly because the reversed nat rule makes no sense.

For example:

The nat rule you configured is:

nat (inside, dmz) source dynamic LAN Pat1 destination static Server1 Server1

The reverse of this rule is:

nat (dmz,inside) source static server1 server 1 destination dynamic Pat1 LAN

The destination cannot be dynamic! This is where packet tracer shows denied due to ACL.

However, I don't think that this specific rule might be the one causing the issue.

An output of "show nat" would help me point out exactly what is wrong.

-Shrikant