ASA 8.0 nat0 statement problem

[Kurt Lei]

Hi All,

ASA is working on 8.0 and I would like to bypass NAT which from 10.131.3.0 to 10.130.8.0. 

Refer to nat0 document, it is clearly stated that nat0 is worked for bypassing NAT. However, I want to clarify, refer to below configuration, if nat0 statement works, does it refer to the routing table (route inside 10.0.0.0 255.0.0.0 10.131.3.1) to next hop ?

==========================================================

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 10.0.0.0 255.0.0.0

access-list inside_nat0_outbound extended permit ip 10.131.3.0 255.255.255.0 10.130.8.0 255.255.255.0 

route outside 0.0.0.0 0.0.0.0 203.221.172.210 1

route inside 10.0.0.0 255.0.0.0 10.131.3.1 1

[Vibhor Amrodia]

Hi,

Just to clarify , the NAT and route lookup and different phases of a packet on the ASA device.

So , yes the ASA would have to look at the routing table in order to pass the traffic in addition to the Nat Exempt statement.

Packet Flow thru ASA:-

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113396-asa-packet-flow-00.html

You can check all these phases on the ASA using the Packet Tracer command:-

https://supportforums.cisco.com/document/29601/troubleshooting-access-problems-using-packet-tracer

Thanks and Regards,

Vibhor Amrodia

[Kurt Lei]

Thx Vibhor, however, I wonder why when I traceroute, the first hop is to outside interface but didn't following the route. So I want to confirm whether to add the NAT exemption station can solve my problem.

[Vibhor Amrodia]

Hi,

No , NAT exemption wouldn't help with that.

You can check this document about the trace route and how it works on ASA device:-

http://www.cisco.com/c/en/us/support/docs/security/pix-500-series-security-appliances/15246-31.html#trace

Thanks and Regards,

Vibhor Amrodia

[Kurt Lei]

Hi Vibhor,

Thanks for your advise. Actually, I'm still struggling on this case. In fact, there is a Solarwind server is responsible to collect the syslog of ASA. I found ASA is failed to The solarwind is placed at inside zone, when I traceroute from ASA to Solarwind and found the traffic is going to Outside zone. I am wonder why the traffic is still going to outside even there is a static route to inside zone.

route inside 10.0.0.0 255.0.0.0 10.131.3.1 <---- Inside zone

Can you give me some suggestion ?

[Vibhor Amrodia]

Hi,

Firstly , Check for existing connections for this Server IP , If it is pointing to the Outside interface , it would override the route statement.

Secondly , Try to check the policy flow using the Packet Tracer:-

https://supportforums.cisco.com/document/29601/troubleshooting-access-problems-using-packet-tracer

Thanks and Regards,

Vibhor Amrodia

[Kurt Lei]

Hi Vibhor,

I found no any connection entry of the server in ASA.

And I finally got the show route from the customer. It's really strange, there is no static route on the configuration but there is an entry when show route.

S    10.130.0.0 255.255.0.0 [1/0] via (Outside GW), outside

However, I have another issue is that some subnet should go to this Outside gateway. The criteria is that only the inside subnet (i.e. 10.131.3.0) will back to MPLS connection and should use below route. 

S    10.0.0.0 255.0.0.0 [1/0] via 10.131.3.1, inside

I know there is no any policy routing in ASA 8.0, how can I achieve it ?