Cisco ASA 9.1(1) Cannot Ping Public Server

[Michael Darr]

Cisco ASA 9.1(1) I have defined a public server.  Ping from outside fails.  Packet Tracer shows the following:

What is going on here?

[johnd2310]

Hi,

It seems Packet Tracer is showing the IP as on Inside-Test interface. Is the routing configured correctly?

Thanks

John

[Vibhor Amrodia]

Hi,

I think the routing is correct.

It is a RPF drop. If you check the 1st NAT phase , that NAT statement seems to be different than the one in the displayed section.

This is the reason for this drop.

I would request you to send me the NAT configuration and the complete trace output.

Thanks and Regards,

Vibhor Amrodia

[Michael Darr]

Thank you for responding, Vibhor:  Here are the pertinent NAT statements in my running configuration:

object network Grede-Test-Server
host xx.xx.xx.xx (Public IP Address)
description Grede Test Server Menocon

object network Grede-Test-Server-Private
host 10.1.104.21
description Grede-Test Server

nat (Inside-Test,Outside) source static Grede-Test-Server-Private Grede-Test-Server

Cheers,

M.

[Vibhor Amrodia]

Hi,

Thank you for updating the NAT statement. I would request you to still update me with the Complete Packet Tracer as this is a NAT misconfiguration causing this issue.

I think there might be another NAT configured which is causing this issue on the ASA device.

Thanks and Regards,

Vibhor Amrodia

[Michael Darr]

I have attached the response.

[Vibhor Amrodia]

Hi,

The Packet Tracer is incorrect.

You need to use the destination ip in it as the Public IP instead of the Private Ip as you have used.

Correct that and let me know what you get as the output from the tracer.

Thanks and Regards,

Vibhor Amrodia

[Michael Darr]

Hi, John;

That is correct.  It is an isolated test server on an isolated test network.  Does not everyone have one of these for testing firewall configuration?  Thanks for the response.

Cheers,

M.