ASA Static NAT

[pemasirid]

Hi,

I'm having a strange issue and appreciate if anyone have faced simillar issue and got some solution/workaround.

I have static nat (inside,outside) and allowed all the required ports accessing from outside via ACL applied on outisde interface in direction. firewall nat-control is enabled. when I tried packet tracer i got the attached output. (step 8, nat-exeception - Drop). However when I change the inside ip (which is already having static nat entry with outside, but just for testing) it worked..? I have required routing, gateway for inside server is the firewall inside, no any host routes in the inside server in question.

The issue I see here is that when ever you used new static entry it does not work..???? has anyone faced simillar problem and can get some idea..?

Attached file contain the relevant configuraiton and packet tracer output for working and non working IPs (working IP inside is 172.16.1.125 and non working ip is 172.28.1.196).

thanks

[mirober2]

Hello,

The connection to 172.16.125.25 fails because of the NAT RPF check. This check requires that the forward flow (client -> server) matches the same NAT rules as the reverse flow (server -> client). You should double check your NAT rules and see which ones match for when 172.28.1.196 talks to 172.16.65.48. If you have trouble spotting the overlap, please share a sanitized copy of 'show run nat', 'show run global', and 'show run static'.

-Mike