Accepted Solutions
Hi,
Seems theres not really much complicating the configuration that might explain the problem.
Don't really have a chance to lab this setup myself at the moment but I know we have had some problems with shared Vlan use on FWSM also but nothing that would really help me in this situation.
One thing I noticed that you are not doing any NAT other than for LAN -> WAN traffic, unless you have removed some configurations. I think the "nat-control" is at its default which would mean "no nat-control"
What also confuses me is that the log messages talk about dynamic translations when you have generated traffic. I wonder if making a Static NAT statement affec the situation at all. (Even though NAT configurations shouldnt be needed if you specifically want to NAT some address)
In the case of the first Context (that you posted) I guess the typical NAT configuration that we would do would be
static (inside,SHARED) 10.255.12.0 10.255.12.0 netmask 255.255.255.0
Which in case of "nat-control" would enable "inside" to communicate with "SHARED" interface hosts with their original IP address (Other option would be to configure NAT0/NAT Exempt)
Also one thing you havent configured, unless its taken from the configuration, is "sysopt noproxyarp SHARED". This command would be of any use in your setup. We usually configure this to customer context LAN interfaces which have direct connection to customer L2 network segment so the FWSM doesnt reply to any ARP request instead of a actual host.
Also one thing I noticed which probably isnt any issue but is different between the contexts is that the first one doesnt have the "inspect icmp" configuration. Though since you have opened traffic between the interfaces ICMP should work normally.
Sadly I can't give you an answer as to what is causing this.
Personally I would just go through the whole path of the traffic (even though you have stated that this only happens with these Linux devices) and possibly play around with the NAT configurations. Ofcourse I don't know how much chances you have to touch the configurations in these setups if they are part of a critical production enviroment.
Heres some quotes from Cisco FWSM documentation related to the "nat-control" and "sysopt noproxyarp" configuration commands
sysopt noproxyarp
To disable proxy ARP for NAT global addresses on an interface, use the sysopt noproxyarp command in global configuration mode. To reenable proxy ARP for global addresses, use the no form of this command.
sysopt noproxyarp interface_name
no sysopt noproxyarp interface_name
Syntax Description
Defaults
Proxy ARP for global addresses is enabled by default.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
Usage Guidelines
In rare circumstances, you might want to disable proxy ARP for global addresses.
When a host sends IP traffic to another device on the same Ethernet network, the host needs to know the MAC address of the device. ARP is a Layer 2 protocol that resolves an IP address to a MAC address. A host sends an ARP request asking "Who is this IP address?" The device owning the IP address replies, "I own that IP address; here is my MAC address."
Proxy ARP is when a device responds to an ARP request with its own MAC address, even though the device does not own the IP address. The FWSM uses proxy ARP when you configure NAT and specify a global address that is on the same network as the FWSM interface. The only way traffic can reach the hosts is if the FWSM uses proxy ARP to claim that the FWSM MAC address is assigned to destination global addresses.
Examples
The following example disables proxy ARP on the inside interface:
hostname(config)# sysopt noproxyarp inside
nat-control
To enforce NAT control use the nat-control command in global configuration mode. NAT control requires NAT for inside hosts when they access the outside. To disable NAT control, use the no form of this command.
nat-control
no nat-control
Syntax Description
This command has no arguments or keywords.
Defaults
NAT control is disabled by default (no nat-control command). If you upgraded from an earlier version of software, however, NAT control might be enabled on your system because it was the default in some earlier versions.
Command Modes
The following table shows the modes in which you can enter the command:
Global configuration
•
•
•
•
—
Command History
3.1(1)
This command was introduced.
3.2.(1)
NAT is now supported in transparent firewall mode.
Usage Guidelines
NAT control requires that packets traversing from an inside interface to an outside interface match a NAT rule; for any host on the inside network to access a host on the outside network, you must configure NAT to translate the inside host address.
Interfaces at the same security level are not required to use NAT to communicate.
By default, NAT control is disabled, so you do not need to perform NAT on any networks unless you choose to perform NAT.
If you want the added security of NAT control but do not want to translate inside addresses in some cases, you can apply a NAT exemption (nat 0 access-list) or identity NAT (nat 0 or static) rule on those addresses.
Note
Examples
The following example enables NAT control:
hostname(config)# nat-control
Whole command reference can be found at
http://www.cisco.com/en/US/docs/security/fwsm/fwsm40/command/reference/fwsm_ref.html
- Jouni
