ASA 5505/NAT/Packet Tracer: Only connected subnet NATed, not others Internal subnets

[computerone1]

Hi folks!

I'm modeling a simple network in Packet Tracer.7.0:

The IP topology is functionning OK, PC0 can ping Server0 (there is a static route in the router 'Internet' 10.0.0.0 255.0.0.0 203.0.113.47).

Yet, NAT is performed only when a ping is sent from R1, not from L3S0 or PC0 (checked using the Sniffer module).

I tried many different NAT settings for 4 hours ( changing the 10.0.0.0/30 for a 10.0.0.0/24, using 'host [PC0 IP]' instead of subnet, using (any,outside) instead of (inside,outside).

HTTP requests get the same problem, it's not just ICMP

either:

• I make a big mistake in my NAT config (yet I checked the doc for 4 hours)
• There is a bug in PacketTracer/ASA5505/NAT
• The ASA 5505 can only NAT the directly connected subnet

I post the ASA startup config file for anybody wishing to check it

Thanks for any idea :-)

[Spooster IT Services · Accepted solution]

Hi computerone1,

Yes there is a bug in pccket tracer. But you can do something like the following.

Change the subnet mask of ASA inside to 255.0.0.0 from 255.255.255.252

interface Vlan1
nameif inside
security-level 0
ip address 10.0.0.2 255.0.0.0

object network inside-subnet
subnet 10.0.0.0 255.0.0.0
nat (inside,outside) dynamic interface

!

At router R1,  ASA facing interface,

interface fastethernet/Gig <x/x>
ip add 10.0.0.1 255.255.255.252
ip proxy-arp

And test again...

[computerone1]

Hi Spooster IT Services

Your solution works perfectly.

Thanks and marked as solved !