We are talking about the same thing so please accept my update on this matter:
I did try what you suggested and the result is the same. It is not creating pat-pool over few addresses.
WIth interface keyword it creates a pat over one address (of external IF) and then 1-1 nat pool of the pool object group specified in nat command:
NAT from DMZ:172.16.0.102 to outside:1.1.1.10 flags i idle 0:00:40 timeout 3:00:00
NAT from DMZ:172.16.0.101 to outside:1.1.1.9 flags i idle 0:00:48 timeout 3:00:00
UDP PAT from DMZ:172.16.0.163/41364 to outside:1.1.1.2/64950 flags ri idle 0:00:01 timeout 0:00:30
1.1.1.2 is external interface
.9 and .10 are in the DMZ_nat_pool object range
When pool gets exhausted by either packet tracer and or real hosts it cannot create any new translations.
When dynamic pat over pool is configured it is not attempting to use the pat anymore It does nat only for the number of hosts that are in the pool and then stops giving error message.
There was also another nat rule with twice-nat so I added it in front of everything:
nat (DMZ,outside) 1 source dynamic DMZ_network DMZ_nat_pool
That didn't help too.
I did try using 'interface' keyword that you suggested but also no luck.
Do I have to reload the box or do anything else than 'clear xlate' to be effective.
I did try deleting DMZ_nat_pool and DMZ_network objects and re-creating them. No luck
When looking at the debug there is a message:
nat: WARNING - alloc socket in pool -1401456072 failed, prot 17/0, DMZ:172.16.0.5/54435 to outside
As a another idea I tried to do multiple host like mappings for outside traffic hoping it will start doing pat over pool properly.
dfw-prod-asa-01(config)# object network obj_100
dfw-prod-asa-01(config-network-object)# host 1.1.1.100
dfw-prod-asa-01(config-network-object)# exit
dfw-prod-asa-01(config)# object network obj_101
dfw-prod-asa-01(config-network-object)# host 1.1.1.101
dfw-prod-asa-01(config-network-object)# exit
dfw-prod-asa-01(config)# nat (DMZ,outside) source dynamic DMZ_network obj_100
dfw-prod-asa-01(config)# nat (DMZ,outside) source dynamic DMZ_network obj_101
WARNING: Pool (1.1.1.101) overlap with existing pool.
When pool is exhausted any new packet generated is giving such error:
dfw-prod-asa-01(config)# packet-tracer input DMZ icmp 172.16.0.211 0 0 8.8.8.8
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside
Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 3
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:
Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: DEBUG-ICMP
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: NAT
Subtype:
Result: DROP
Config:
nat (DMZ,outside) source dynamic DMZ_network DMZ_nat_pool interface
Additional Information:
Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Any ideas?
Has anyone seen this behaviour before?
dfw-prod-asa-01(config)# show ver
Cisco Adaptive Security Appliance Software Version 8.3(2)
Device Manager Version 6.2(1)
Compiled on Fri 30-Jul-10 17:49 by builders
System image file is "disk0:/asa832-k8.bin"
Config file at boot was "startup-config"
dfw-prod-asa-01 up 2 days 20 hours
failover cluster up 9 days 10 hours
Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1599 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB
MB
