Hi @ all,
first of all i have to say i was dissapointed in Cisco changing whole NAT configuration Style radicaly. It took me ages to convert the old statements from my preavious working configuration. Anyway. (maybe its just about my incompetence)
Info:
I have a Cisco ASA 5510 running 8.3(2) which should replace an existing firewall. I did initial configuration with Pre-8.3 Version without the following issue.
Interace Ethernet 0/0 ist connected to a ADSL Modem of the Provider who provides the static IP Adress over pppoe
Interface Ethernet 0/1 is connected with staic IP to a Backup ADSL Router for backup internet access of our internal network
Interface Ethernet 0/2 and 0/3 are conected to the internal switches implemented in a Redundant interface configuration
For Internet Access backup i use the SLA monitor to track the outside getaway of the ISP if this fails 3 times the routes gonna be changed to the ethernet 0/1
PPPoE configuration
vpdn group VTX_ADSL2+ request dialout pppoe
vpdn group VTX_ADSL2+ ppp authentication chap
vpdn group VTX_ADSL2+ localname XXXXXXX
vpdn username XXXXXX password XXXXXX
Interface Ethernet 0/0
ip address pppoe setroute (also tryed ip address XXX.XXX.XXX.XXX 255.255.255.255 pppoe setroute)
pppoe client vpdn group VTX_ADSL2+
SLA configuration:
sla monitor 100
type echo protocol ipIcmpEcho XXX.XXX.XX.52 interface outside
num-packets 3
frequency 10
exit
sla monitor schedule 100 life forever start-time now
track 1 rtr 100 reachability
Route configuration:
route outside 0.0.0.0 0.0.0.0 XX.XXX.XXX.52 1 track 1
route outside 0.0.0.0 0.0.0.0 XXX.XXX.XXX.51 1 track 1
route outside_backup 0.0.0.0 0.0.0.0 10.10.5.1 254
NAT configuration:
nat (outside,inside_192.168.1.0_24) 1 source static obj_outside_host_smtp_xxx.xxxxx.xx obj_outside_host_smtp_xxx.xxxxx.xxdestination static interface obj_inside_server_kolab2 service obj_service_smtp obj_service_smtp unidirectional
nat (outside,inside_192.168.1.0_24) 2 source static obj_outside_host_smtp_yyyy.xxxxx.xx obj_outside_host_smtp_yyyy.xxxxx.xx destination static interface obj_inside_server_kolab2 service obj_service_smtp obj_service_smtp unidirectional
nat (outside,inside_192.168.3.0_24) 3 source static any any destination static interface obj_inside_steuerung_camera_mobotix service obj_service_avira_smc_nat obj_service_http unidirectional
nat (outside,inside_192.168.1.0_24) 4 source static any any destination static interface obj_inside_steuerung_netlinx service obj_service_netlinx_studio obj_service_netlinx_studio unidirectional
nat (outside,inside_192.168.1.0_24) 5 source static any any destination static interface obj_inside_server_kolab2 service obj_service_https obj_service_https unidirectional
nat (outside,inside_192.168.1.0_24) 6 source static any any destination static interface obj_inside_server_kolab2 service obj_service_pop3_ssl obj_service_pop3_ssl unidirectional
nat (inside_192.168.1.0_24,outside) 7 source static obj_inside_network_192.168.1.0_24 obj_inside_network_192.168.1.0_24 destination static grp_outside_vpn_networks grp_outside_vpn_networks
nat (any,outside) 8 source dynamic any interface
nat (any,outside_backup) 9 source dynamic any interface
Target of nat is following:
Rule 1: Incoming Traffic to Outside from Source obj_outside_host_smtp_xxx.xxxxx.xx with SMTP should be forwarde to internal Mailserver
Rule 2: Same as Rule 1 just form other source host
Rule 3: Incoming Traffic to Outside from any source adress on port 7000 should be forwardet to internal camera for http accesss
Rule 4: Incoming Traffic to Outside from any source adress on port 1319 should be forwardet to internal netlinxcontroller 1319
Rule 5: Incoming Traffic to Outside from any source adress on port 443 should be forwardet to internal mailserver 443
Rule 6: Incoming Traffic to Outside from any source adress on port 995 should be forwardet to internal mailserver 995
Rule 7: incoming Traffic to Inside interface from internal servernetwork for destination of vpn network pools should remain original
Rule 8: NAT roule for Internetaccess
Rule 9: NAT roule for internet access on backup line
Problem:
All NAT config ist well testet with packet-tracer an working fine. The Problem ist when then Ethernet 0/0 goes down or losses connection to the provieder, and the routes gonna be changed to backup. The NAT is killing itself anyhow.
If i shutdown the ethernet 0/0 interface i have to wait about 5-10 minutes an geting following form console:
(x.x.x.x) ist outside static IP Adress
WARNING: mapped-address XXX.XXX.XXX.XXX/25-0 ovelap with existing static NAT.
ERROR: NAT Policy is not downloaded
ERROR: NAT Policy is not downloaded
ERROR: NAT Policy is not downloaded
ERROR: NAT Policy is not downloaded
ERROR: NAT Policy is not downloaded
after that rule 1 - 5 disapear in the configuration.
I have to delete whole NAT and reconfigure it to make it working again.
Same thing happens if i reboot the ASA.
i spend ages figuring out the Problem but i could not fix it.
I hope you guys can help me. Rollout of the asa should be next weekend. so i am a little bit busy.
EDIT: I also tried to shutdown pppoe on lab. If the interface does not pppoe it just works fine. The ASA seems to have problem with the PPPoE not ready and killing NAT entry witch include the interface statement for outside interface
