Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
581
Views
0
Helpful
2
Replies

Since upgrading to 8.4(4)1 from 8.3 VPN users cannot access certain resources

paultribe
Level 1
Level 1

‎11-08-2012 07:48 AM - edited ‎03-11-2019 05:20 PM

Since we upgraded our ASA from 8.3 to 8.4(4), VPN users cannot access resources. This worked fine until the appliances were upgraded. We get the message:

5|Nov 08 2012|14:56:33|305013|222.216.126.7|3389|||Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.58.1.3/10134(LOCAL\pttest) dst XXX_INT:222.216.126.7/3389 denied due to NAT reverse path failure

5|Nov 08 2012|14:56:21|305013|222.216.126.7|3389|||Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.58.1.3/10134(LOCAL\pttest) dst XXX_INT:222.216.126.7/3389 denied due to NAT reverse path failure

5|Nov 08 2012|14:56:15|305013|222.216.126.7|3389|||Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.58.1.3/10134(LOCAL\pttest) dst XXX_INT:222.216.126.7/3389 denied due to NAT reverse path failure

5|Nov 08 2012|14:56:12|305013|222.216.126.7|3389|||Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.58.1.3/10134(LOCAL\pttest) dst XXX_INT:222.216.126.7/3389 denied due to NAT reverse path failure

I know this is a NAT problem and our NAT rules are as follows, can anyone suggest a fix (Note I have changed IPs and names for security):

nat (XXX_INT,outside) source static obj-10.110.3.0 obj-10.110.3.0 destination static obj-192.168.57.0 obj-192.168.57.0 no-proxy-arp route-lookup
nat (XXX_INT,outside) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.1.0.0 obj-10.1.0.0 no-proxy-arp route-lookup
nat (EMBC-INT,outside) source static obj-10.60.0.0 obj-10.60.0.0 destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup description NAT exemption for AnyConnect connections to Schools Servers
nat (XXX_INT,outside) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup
nat (XXX_INT,outside) source static obj-10.58.1.0 obj-10.58.1.0 destination static Public_DMZ Public_DMZ no-proxy-arp route-lookup
nat (XXX_INT,XXX_INT) source static obj-10.58.1.0 obj-10.58.1.0 destination static Public_DMZ Public_DMZ no-proxy-arp route-lookup
nat (XXX_INT,XXX_INT) source static Public_DMZ Public_DMZ destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup
nat (XXX_INT,EMBC-EXT) source static obj-10.110.3.0 obj-10.110.3.0 destination static obj-192.168.57.0 obj-192.168.57.0 no-proxy-arp route-lookup
nat (XXX_INT,EMBC-EXT) source static obj-10.58.1.0 obj-10.58.1.0 destination static Public_DMZ Public_DMZ no-proxy-arp route-lookup
nat (XXX_INT,EMBC-EXT) source static Public_DMZ Public_DMZ destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup
nat (XXX_INT,bogus) source static obj-10.110.3.0 obj-10.110.3.0 destination static obj-192.168.57.0 obj-192.168.57.0 no-proxy-arp route-lookup
nat (XXX_INT,bogus) source static Public_DMZ Public_DMZ destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup
nat (XXX_INT,outside) source static Supplies NAT-County-Supplies-Server destination static Iris_Networks Iris_Networks
nat (XXX_INT,outside) source static obj-10.110.3.244 NAT-ASA-Internal destination static obj-192.168.57.0 obj-192.168.57.0
nat (XXX_INT,outside) source static L2L-IPSEC-LOGICA-LOCAL L2L-IPSEC-LOGICA-LOCAL destination static L2L-IPSEC-LOGICA-REMOTE L2L-IPSEC-LOGICA-REMOTE no-proxy-arp route-lookup
nat (XXX_INT,outside) source static Supplies NAT-County-Supplies-Server destination static obj-192.168.57.0 obj-192.168.57.0
nat (EMBC-INT,outside) source static NETWORK_OBJ_10.60.0.115 NETWORK_OBJ_10.60.0.115 destination static NETWORK_OBJ_172.18.143.0_28 NETWORK_OBJ_172.18.143.0_28 no-proxy-arp route-lookup
nat (XXX_INT,outside) source static AP22-0029 Chipside_NAT_AP22 destination static Chipside_Payment_Processing Chipside_Payment_Processing
nat (outside,outside) source dynamic obj-10.58.1.0 interface destination static Extranet-DMZ Extranet-DMZ description NAT connections to Extranet VPN servers behind the ASA's Extranet DMZ interface
nat (outside,outside) source dynamic L2L-IPSEC-LOGICA-REMOTE interface destination static Extranet-DMZ Extranet-DMZ description NAT connections to Extranet VPN servers behind the ASA's Extranet DMZ interface
nat (XXX_INT,XXX_INT) source static obj-10.110.3.0 obj-10.110.3.0 destination static obj-192.168.57.0 obj-192.168.57.0
nat (XXX_INT,XXX_INT) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.1.0.0 obj-10.1.0.0
nat (XXX_INT,XXX_INT) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.58.1.0 obj-10.58.1.0
!
object network obj_any
nat (EMBC-INT,outside) dynamic obj-0.0.0.0
object network obj_any-01
nat (EMBC-INT,EMBC-EXT) dynamic obj-0.0.0.0
object network obj_any-02
nat (EMBC-INT,bogus) dynamic obj-0.0.0.0
object network obj_any-03
nat (XXX_INT,outside) dynamic obj-0.0.0.0
object network obj_any-04
nat (XXX_INT,EMBC-EXT) dynamic obj-0.0.0.0
object network obj_any-05
nat (XXX_INT,bogus) dynamic obj-0.0.0.0
object network obj_any-06
nat (bogus,outside) dynamic obj-0.0.0.0
object network obj_any-07
nat (bogus,EMBC-EXT) dynamic obj-0.0.0.0

Labels:
0 Helpful
2 Replies 2

Stuart Gall
Level 1
Level 1

‎11-08-2012 08:11 AM

Config migration FAIL

Ok
For a start, what is
nat (EMBC-INT,outside) dynamic obj-0.0.0.0

That can't be right try
Nat (EMBC-INT,outside) dynamic




Sent from Cisco Technical Support iPad App

0 Helpful

paultribe
Level 1
Level 1
In response to Stuart Gall

‎11-12-2012 12:48 AM

Hi

I am new to this ASA and I believe there are some old rules that actually are not required, mainly the dynamic PAT rules. Are you saying that because these exist they are affecting NAT exemnption from working, the exemption rules did work OK prior to 8.4(4)1 being installed.

Basically we have a VPN group which gets its IP addresses from the address range 10.58.1.0 / 24, whom have to access servers on subnet 222.216.126.0 / 24. This subnet is located on another firewall. The config pertaining to all this is as follows:

name 222.216.120.0 Public_DMZ

object network Public_DMZ

subnet 222.216.120.0 255.255.248.0

route XXX_INT Public_DMZ 255.255.248.0 Nokia_VIP 1  (Could it be this route that is causing the problem, as it is not specific enough as as the object above).

I am not sure which NAT rule in 8.3 allowed the access to work. I would have thought the rule may look something like this, but I am new to ASA 8.4.

object network Public_DMZ
subnet 222.216.120.0 255.255.248.0

object network obj-10.58.1.0
subnet 10.58.1.0 255.255.255.0

nat (XXX_INT,outside) source static obj-10.58.1.0 obj-10.58.1.0 destination static Public_DMZ Public_DMZ no-proxy-arp route-lookup

This rule exists but is below another rule (See below), which is being hit first.

nat (XXX_INT,outside) source static obj-10.0.0.0 obj-10.0.0.0 destination static obj-10.58.1.0 obj-10.58.1.0 no-proxy-arp route-lookup

0 Helpful
Customers Also Viewed These Support Documents
Review Cisco Networking for a $25 gift card