Changing priority of Static NAT over NAT exempt rule

[jon.seung@applecaremedical.com]

Hello,

Suppose we have two NAT rules under 'NAT Rules';

#    Type          Original (Source)     Original (Destination)        Interface (Translated)     Address(Translated)

1    Exempt      ANY                        ANY                                 Outbound
2    Static        Web_internal           ANY                                  Outside (Web_external)

Firewall accept inbound access to the external IP address (Statically NATed) of Web_external however I'm seeing asymmetric routing issue on ASA log.

Asymmetric NAT rules matched for forward and reverse flows- denied due to NAT reverse path failure.

I see NAT exemption rule (#1) is overwritting statc NAT for the outbound.
Is there any way we could put the highest priority on Static NAT over NAT exemption rule?

There is up/down arrow for both NAT exemption and static rule but static rule can not go above the NAT exemption rule.

[Francesco Molino]

Hi

Here an explain on how may is processed on asa:
https://supportforums.cisco.com/t5/security-documents/asa-nat-8-3-nat-operation-and-configuration-format-cli/ta-p/3143050

Can you share your config and give us the source ip and destination ip? With that information we'll be able to help you.