nat (dmz, any) problem 8.4(2)

[Anatoly Fedchik]

Hello,

Something strange with nat command the following nat command excellent works on ASA 8.4(2) but fails on ASA 8.4(4):

nat (dmz,any) source static dmz_srv pub_srv

I perform clear xlate, shutdown interface dmz    but with no success.

p.s. i have changed the nat(dmz,outside) to nat(dmz,any) in order to access dmz host by public ip

[Jouni Forss]

How is it not working?

Are you trying to translate some DMZ server local IP address to public IP address towards every interface of the ASA?

Can you perhaps share the whole NAT configuration?

You could also consider trying the "packet-tracer" command to simulate the connections that arent working so we could see whats happening with regards to the NAT.

- Jouni

[Anatoly Fedchik]

I have lab with the same config but on ASA 8.4(2) and in this lab everything is ok, but in production when i changed

nat(dmz,outside) to nat(dmz,any) i cant access the dmz host by public ip from inside interface, at the same time in lab it works.

I have no problem with access the dmz host from outside interface  in the both cases.

nat (inside,outside) source dynamic LANSUBNET outside_wlan

nat (dmz,any) source static dmz_srv pub_srv

[Jouni Forss]

Hi,

Can you test the problematic connection with the "packet-tracer" command and copy/paste output here.

I guess the command would be something like this

packet-tracer intput inside tcp

Where

• user source ip = Is the IP address of the user behind the "inside" that cant access the DMZ server with the public IP address
• dmz nat ip = Is the IP address that the DMZ server is NATed to towards "outside" and "inside"

If the above NAT configurations are all your current configurations truly then I would suggest the following changes

Remove them and configure them again as follows

Default PAT

object-group network DEFAULT-PAT-SOURCE

network-object

object network PAT

host

nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE PAT

OR IF YOU USE THE "outside" INTERFACE AS THE PAT IP THEN USE

object-group network DEFAULT-PAT-SOURCE

network-object

nat (inside,outside) after-auto source dynamic DEFAULT-PAT-SOURCE interface

Static NAT

object network DMZ-STATIC

host

nat (dmz,any) static

I guess you could first try the "packet-tracer" command though. Though I suspect you might be running in to problem with the order of the NAT configuration

Maybe this

nat (inside,outside) source dynamic LANSUBNET outside_wlan

nat (dmz,any) source static dmz_srv pub_srv

Should be this

nat (dmz,any) source static dmz_srv pub_srv

nat (inside,outside) source dynamic LANSUBNET outside_wlan

Not really sure

- Jouni

[Anatoly Fedchik]

The problem was in routing on the host(dmz_srv).  The ASA config was ok.

Thanks Jouni for your help.