ASA 5506 Dynamic NAT IP address traffic flow ceases.

[Michael Jackson]

Good afternoon,

I have a Cisco ASA 5506 on a Spectrum Ubee cable modem. We have a block of 7 static IP addresses.  We are using 4 of the addresses.  One is the primary IP of the router which allows client internet access via dynamic NAT, as well as remote VPN.  Three other 3 are static NAT addresses assigned to three devices inside the network.

Randomly - anywhere between 3 times a day to sometimes once every few days - the primary IP address (and only the primary) using dynamic NAT seems to go dark.  I cannot ping it from outside.  All internet traffic flow for internal clients stops, and VPN will not answer.  I CAN still access the services on the three other static NAT IP addresses.  In fact one of those is a server that I can actually still remote to gain access to the ASA and repair the issue.  So the Internet circuit is up and passing traffic for these static IP addresses.

I have figured out that instead of rebooting the firewall, I can simply "clear arp" and the dynamic nat ip comes back up.

I have talked to Spectrum who have basically said "not our issue".  I have so many ASA on Ubee devices out there, but only this one is an issue.  I want it to be Spectrum's problem, but is these anything on the ASA that might account for this, and how can I fix it?

N. Michael Jackson - NMJ Technology LLC

[Aref Alsouqi]

Looks like the ASA runs out of PAT allocation. I would try to configure an object with one or two public IP addresses, and configure the interface as a fallback if the PAT allocation should exhaust. Here is an example:

object network PAT-POOL

 range 1.2.3.4 1.2.3.5

nat (inside,outside) after-auto source dynamic <LAN object> PAT-POOL interface

If you want to use one single public IP, you can just replace the .5 with the same IP .4:

range 1.2.3.4 1.2.3.4

[Michael Jackson · Accepted solution]

The solution was we threw Spectrum out and put in an AT&T fiber circuit.  Problem solved.

Thanks for all that responded.