Exempting PAT on the return path from connections initiated on the outside interface

[KenDedesko]

Hi

We have a situation with an ASA where there is a PAT set up for connections from the inside interface to the outside (mpls, not the Internet). 

There are certain connections initiated from a remote site that come in on the outside interface to a real server's IP address. The PAT kicks in on the return and the connection is no longer valid.

Is there a way to disable PAT for connections that come in on the outside interface?

The weirdness is that when the source is PAT'd, and there was an outside NAT on the router, it worked. The PAT did not get executed.  When we moved the outside NAT over to the remote firewall at the other end, the PAT now always kicks in.

Thanks

Ken

[Rob Ingram]

Hi,
I've not tried it, but how about defining a unidirectional NAT exemption rule. Create this rule above your dynamic PAT rule and that might do what you want.

HTH