VPN issue

[boodoorajesh]

Good day all,

I am having a strange issue that have be baffled for the past few days. I have a S2S Policy-based VPN setup between 2 sites. One site has a FPR2110 (software: 7.4.2-172)  and the other a FPR3110 (software: 7.6.6-115). I have dual ISPs on both sites and they are setup for failover. The main ISP is a Static Public IP (ISP1) and the backup is PPPoE (ISP2). The VPN between works fine when using the ISP1. However, when I failover to ISP2 on the FPR3110, the tunnel establishes but it is not passing traffic on both ends. FPR2110 shows that it is sending traffic but not receiving and FPR3110 shows it is receiving but not sending. The IKE Policy and IPSec Proposal matches on both ends. The S2S on both ends are configured correctly.

Here is the strange part. When I replace the FPR2110 with a FPR1010 (software: 7.6.4-69) with the identical configurations as the FPR2110, everything works fine. Also, the FPR3110 with the FPR1010 also works fine. To summarize:

• FPR3110 with FPR2110 - Main VPN works but not the failover
• FPR3110 with FPR1010 - Both main and failover VPN works
• FPR2110 with FPR1010 - Both main and failover VPN works

Result of show crypto ipsec sa detail on FPR3110

Crypto map tag: s2sCryptoMap, seq num: 15, local addr: XXX.XXX.38.131

access-list |s2sAcl|14c46a12-c3d6-11f1-9f75-03f216e5c322 extended permit ip 192.168.75.0 255.255.255.0 192.168.0.0 255.255.255.0
Protected vrf (ivrf):
local ident (addr/mask/prot/port): (192.168.75.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
current_peer: XXX.XXX.213.115

#pkts encaps: 2269, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 455, #pkts decrypt: 455, #pkts verify: 455
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 2269, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (send): 0, #pkts invalid ip version (rcv): 0
#pkts invalid len (send): 0, #pkts invalid len (rcv): 0
#pkts invalid ctx (send): 0, #pkts invalid ctx (rcv): 0
#pkts invalid ifc (send): 0, #pkts invalid ifc (rcv): 0
#pkts failed (send): 0, #pkts failed (rcv): 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0

local crypto endpt.: XXX.XXX.38.131/500, remote crypto endpt.: XXX.XXX.213.115/500
path mtu 1492, ipsec overhead 78(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 50189C25
current inbound spi : 82B660F3

inbound esp sas:
spi: 0x82B660F3 (0x0C550E75)
SA State: active
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, CAN_BE_OFFLOADED, OFFLOADED, PIPE_0, }
slot: 0, conn_id: 13, crypto-map: s2sCryptoMap
sa timing: remaining key lifetime (kB/sec): (3916773/24829)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000080
outbound esp sas:
spi: 0x50189C25 (0x000214C1)
SA State: active
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, CAN_BE_OFFLOADED, OFFLOADED, PIPE_0, }
slot: 0, conn_id: 13, crypto-map: s2sCryptoMap
sa timing: remaining key lifetime (kB/sec): (4331520/24829)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

------------------------------------------------------------------

Result of show crypto ipsec sa detail on FPR2110

Crypto map tag: s2sCryptoMap, seq num: 32, local addr: XXX.XXX.213.115

access-list |s2sAcl|85ad2c26-c34e-11f1-8dd9-0d3c64698c0d extended permit ip 192.168.0.0 255.255.255.0 192.168.75.0 255.255.255.0
Protected vrf (ivrf):
local ident (addr/mask/prot/port): (192.168.0.0/255.255.255.0/0/0)
remote ident (addr/mask/prot/port): (192.168.75.0/255.255.255.0/0/0)
current_peer: XXX.XXX.38.131

#pkts encaps: 548, #pkts encrypt: 548, #pkts digest: 548
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 548, #pkts comp failed: 0, #pkts decomp failed: 0
#pre-frag successes: 0, #pre-frag failures: 0, #fragments created: 0
#PMTUs sent: 0, #PMTUs rcvd: 0, #decapsulated frgs needing reassembly: 0
#TFC rcvd: 0, #TFC sent: 0
#Valid ICMP Errors rcvd: 0, #Invalid ICMP Errors rcvd: 0
#pkts no sa (send): 0, #pkts invalid sa (rcv): 0
#pkts encaps failed (send): 0, #pkts decaps failed (rcv): 0
#pkts invalid prot (rcv): 0, #pkts verify failed: 0
#pkts invalid identity (rcv): 0, #pkts invalid len (rcv): 0
#pkts invalid pad (rcv): 0,
#pkts invalid ip version (send): 0, #pkts invalid ip version (rcv): 0
#pkts invalid len (send): 0, #pkts invalid len (rcv): 0
#pkts invalid ctx (send): 0, #pkts invalid ctx (rcv): 0
#pkts invalid ifc (send): 0, #pkts invalid ifc (rcv): 0
#pkts failed (send): 0, #pkts failed (rcv): 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv): 0
#pkts replay failed (rcv): 0
#pkts min mtu frag failed (send): 0, #pkts bad frag offset (rcv): 0
#pkts internal err (send): 0, #pkts internal err (rcv): 0

local crypto endpt.: XXX.XXX.213.115/500, remote crypto endpt.: XXX.XXX.38.131/500
path mtu 1500, ipsec overhead 78(44), media mtu 1500
PMTU time remaining (sec): 0, DF policy: copy-df
ICMP error validation: disabled, TFC packets: disabled
current outbound spi: 82B660F3
current inbound spi : 50189C25

inbound esp sas:
spi: 0x50189C25 (1343790117)
SA State: active
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }
slot: 0, conn_id: 353958, crypto-map: s2sCryptoMap
sa timing: remaining key lifetime (kB/sec): (4285440/24360)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001
outbound esp sas:
spi: 0x82B660F3 (2192990451)
SA State: active
transform: esp-aes-256 esp-sha-256-hmac no compression
in use settings ={L2L, Tunnel, PFS Group 14, IKEv2, }
slot: 0, conn_id: 353958, crypto-map: s2sCryptoMap
sa timing: remaining key lifetime (kB/sec): (3962847/24360)
IV size: 16 bytes
replay detection support: Y
Anti replay bitmap:
0x00000000 0x00000001

FDM Managed and no Windows Firewall issues. I'd appreciate any assistance in troubleshooting this issue.

Thanks.

[Rob Ingram]

@boodoorajesh check you have a NAT exemption rule to ensure traffic is not unintentionally translated, thus not matching the interesting traffic.

[boodoorajesh]

Hi Rob,

I've set NAT exemption for the inside interface in the S2S VPN connection profile. I also set 'sysopt connection permit-vpn' using Flexconfig. This way, no ACLs or NAT rules are required. It works fine when using ISP1 on the FPR3110 without any of these rules. However, for the process of elimination, I did try adding NAT and ACLs for test but it still did not work.

[Rob Ingram]

@boodoorajesh you configure two NAT exemption rules? one for inside > ISP1 and another for inside > ISP2 interface?

Test failover, then run packet-tracer from the CLI to simulate traffic over the second VPN, that would confirm what NAT rule is matched.

Provide the output for "show nat detail"

[boodoorajesh]

Yes, NAT exemption is set for both ISPs. See below for packet-tracer results (All phases are ALLOW).

__________________________________

> packet-tracer input lan1 icmp 192.168.75.50 8 0 192.168.0.6

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 12390 ns
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 13452 ns
Config:
Additional Information:
Found next-hop 100.84.0.1 using egress ifc digicel(vrfid:0)

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Elapsed time: 1416 ns
Config:
nat (lan1,digicel) source static |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 destination static |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface digicel(vrfid:0)
Untranslate 192.168.0.6/0 to 192.168.0.6/0

Phase: 4
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Elapsed time: 4513 ns
Config:
access-group NGFW_ONBOX_ACL global
access-list NGFW_ONBOX_ACL advanced permit object-group |acSvcg-268435458 ifc lan1 any ifc digicel any rule-id 268435458 event-log both
access-list NGFW_ONBOX_ACL remark rule-id 268435458: ACCESS POLICY: NGFW_Access_Policy
access-list NGFW_ONBOX_ACL remark rule-id 268435458: L7 RULE: URL-Filtering
object-group service |acSvcg-268435458
service-object ip
Additional Information:
This packet will be sent to snort for additional processing where a verdict will be reached

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Elapsed time: 4513 ns
Config:
nat (lan1,digicel) source static |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 destination static |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 no-proxy-arp route-lookup
Additional Information:
Static translate 192.168.75.50/0 to 192.168.75.50/0

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 4513 ns
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 4513 ns
Config:
Additional Information:

Phase: 8
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Elapsed time: 14160 ns
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect icmp
service-policy global_policy global
Additional Information:

Phase: 9
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Elapsed time: 2478 ns
Config:
Additional Information:

Phase: 10
Type: VPN
Subtype: encrypt
Result: ALLOW
Elapsed time: 5664 ns
Config:
Additional Information:

Phase: 11
Type: NAT
Subtype: rpf-check
Result: ALLOW
Elapsed time: 2124 ns
Config:
nat (lan1,digicel) source static |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 destination static |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 no-proxy-arp route-lookup
Additional Information:

Phase: 12
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Elapsed time: 29736 ns
Config:
Additional Information:

Phase: 13
Type: NAT
Subtype: per-session
Result: ALLOW
Elapsed time: 708 ns
Config:
Additional Information:

Phase: 14
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Elapsed time: 0 ns
Config:
Additional Information:

Phase: 15
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Elapsed time: 9558 ns
Config:
Additional Information:
New flow created with id 13265, packet dispatched to next module

Phase: 16
Type: EXTERNAL-INSPECT
Subtype:
Result: ALLOW
Elapsed time: 12744 ns
Config:
Additional Information:
Application: 'SNORT Inspect'

Phase: 17
Type: SNORT
Subtype: identity
Result: ALLOW
Elapsed time: 26100 ns
Config:
Additional Information:
user id: no auth, realm id: 0, device type: 0, auth type: invalid, auth proto: basic, username: none, AD domain: none,
src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, abp src: none, abp dst: none, location: none

Phase: 18
Type: SNORT
Subtype: firewall
Result: ALLOW
Elapsed time: 125367 ns
Config:
Network 0, Inspection 0, Detection 2, Rule ID 268435457
Additional Information:
Starting rule matching, zone 1 -> 2, geo 0 -> 0, vlan 0, src sgt: 0, src sgt type: unknown, dst sgt: 0, dst sgt type: unknown, user 9999997, no url or host, no xff
Matched rule ids 268435457 - Allow

Phase: 19
Type: SNORT
Subtype: appid
Result: ALLOW
Elapsed time: 9541 ns
Config:
Additional Information:
service: ICMP(3501), client: (0), payload: (0), misc: (0)

Phase: 20
Type: INPUT-ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Elapsed time: 1062 ns
Config:
Additional Information:
Found next-hop 100.84.0.1 using egress ifc digicel(vrfid:0)

Phase: 21
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Elapsed time: 2478 ns
Config:
Additional Information:
Found flow with id 152, using existing flow

Phase: 22
Type: INPUT-ROUTE-LOOKUP-FROM-OUTPUT-ROUTE-LOOKUP
Subtype: Resolve Preferred Egress interface
Result: ALLOW
Elapsed time: 3186 ns
Config:
Additional Information:
Found next-hop 100.84.0.1 using egress ifc digicel(vrfid:0)

Phase: 23
Type: CP-PUNT
Subtype:
Result: ALLOW
Elapsed time: 4248 ns
Config:
Additional Information:
MAC Access list

Result:
input-interface: lan1(vrfid:0)
input-status: up
input-line-status: up
output-interface: digicel(vrfid:0)
output-status: up
output-line-status: up
Action: allow
Time Taken: 294464 ns

[aleabrahao]

Run the show asp drop command on the FPR2110 while generating traffic.

Run it a few times and check if the counters are increasing.

Also check:

capture ASP type asp-drop all
show capture ASP

If the 2110 is receiving ESP packets and dropping them internally, this will usually reveal the reason.

[boodoorajesh]

Yes. The counters are increasing with show asp drop

capture ASP type asp-drop all match ip 192.168.0.0 255.255.255.0 192.168.75.0 255.255.255.0 shows no result on 2110

However, on the 3110 capture ASP type asp-drop all match ip 192.168.75.0 255.255.255.0 192.168.0.0 255.255.255.0 shows:

1: 16:40:59.789891 192.168.0.107 > 192.168.75.12 icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame snp_classify_table_lookup:6016 flow (NA)/NA

[aleabrahao]

The evidence points much more toward the 3110 dropping the interesting traffic before or during policy processing, rather than the 2110 failing to decrypt it. The acl-drop message on the 3110 is the first hard piece of evidence showing an actual packet being denied, and I'd focus the investigation there before chasing MTU or crypto-engine issues.

[boodoorajesh]

> show nat detail
Manual NAT Policies Implicit (Section 0)
1 (nlp_int_tap) to (amplia) source static nlp_server__http_0.0.0.0_intf2 interface destination static 0_0.0.0.0_4 0_0.0.0.0_4 service tcp https 8844
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: XXX.XXX.131.178/30
Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
Service - Protocol: tcp Real: https Mapped: 8844
2 (nlp_int_tap) to (digicel) source static nlp_server__http_0.0.0.0_intf3 interface destination static 0_0.0.0.0_8 0_0.0.0.0_8 service tcp https 8844
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: XXX.XXX.38.131/32
Destination - Origin: 0.0.0.0/0, Translated: 0.0.0.0/0
Service - Protocol: tcp Real: https Mapped: 8844
3 (nlp_int_tap) to (lan1) source static nlp_server__http_192.168.0.0_intf4 interface destination static 0_192.168.0.0_3 0_192.168.0.0_3 service tcp https 8844
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.0.0/24, Translated: 192.168.0.0/24
Service - Protocol: tcp Real: https Mapped: 8844
4 (nlp_int_tap) to (lan1) source static nlp_server__http_192.168.75.0_intf4 interface destination static 0_192.168.75.0_2 0_192.168.75.0_2 service tcp https 8844
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.75.0/24, Translated: 192.168.75.0/24
Service - Protocol: tcp Real: https Mapped: 8844
5 (nlp_int_tap) to (lan1) source static nlp_server__ssh_192.168.0.0_intf4 interface destination static 0_192.168.0.0_5 0_192.168.0.0_5 service tcp ssh ssh
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.0.0/24, Translated: 192.168.0.0/24
Service - Protocol: tcp Real: ssh Mapped: ssh
6 (nlp_int_tap) to (lan1) source static nlp_server__ssh_192.168.75.0_intf4 interface destination static 0_192.168.75.0_6 0_192.168.75.0_6 service tcp ssh ssh
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.75.0/24, Translated: 192.168.75.0/24
Service - Protocol: tcp Real: ssh Mapped: ssh
7 (nlp_int_tap) to (lan1) source dynamic nlp_client_0_192.168.0.0_6proto22_intf4 interface destination static nlp_client_0_ipv4_2 nlp_client_0_ipv4_2 service nlp_client_0_6svc22_1 nlp_client_0_6svc22_1
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.0.0/24, Translated: 192.168.0.0/24
Service - Origin: tcp destination eq ssh , Translated: tcp destination eq ssh
8 (nlp_int_tap) to (lan1) source dynamic nlp_client_0_192.168.75.0_6proto22_intf4 interface destination static nlp_client_0_ipv4_4 nlp_client_0_ipv4_4 service nlp_client_0_6svc22_3 nlp_client_0_6svc22_3
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
Destination - Origin: 192.168.75.0/24, Translated: 192.168.75.0/24
Service - Origin: tcp destination eq ssh , Translated: tcp destination eq ssh
9 (nlp_int_tap) to (amplia) source dynamic nlp_client_0_intf2 interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: XXX.XXX.131.178/30
10 (nlp_int_tap) to (digicel) source dynamic nlp_client_0_intf3 interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: XXX.XXX.38.131/32
11 (nlp_int_tap) to (lan1) source dynamic nlp_client_0_intf4 interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 192.168.75.1/24
12 (nlp_int_tap) to (management) source dynamic nlp_client_0_intf5 interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 169.254.1.3/32, Translated: 203.0.113.130/29
13 (nlp_int_tap) to (amplia) source dynamic nlp_client_0_ipv6_intf2 interface ipv6
translate_hits = 0, untranslate_hits = 0
Source - Origin: fd00:0:0:1::3/128, Translated:
14 (nlp_int_tap) to (digicel) source dynamic nlp_client_0_ipv6_intf3 interface ipv6
translate_hits = 0, untranslate_hits = 0
Source - Origin: fd00:0:0:1::3/128, Translated:
15 (nlp_int_tap) to (lan1) source dynamic nlp_client_0_ipv6_intf4 interface ipv6
translate_hits = 0, untranslate_hits = 0
Source - Origin: fd00:0:0:1::3/128, Translated:
16 (nlp_int_tap) to (management) source dynamic nlp_client_0_ipv6_intf5 interface ipv6
translate_hits = 0, untranslate_hits = 0
Source - Origin: fd00:0:0:1::3/128, Translated:

Manual NAT Policies (Section 1)
1 (lan1) to (digicel) source static |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 destination static |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 no-proxy-arp route-lookup
translate_hits = 289, untranslate_hits = 417
Source - Origin: 192.168.75.0/24, Translated: 192.168.75.0/24
Destination - Origin: 192.168.0.0/24, Translated: 192.168.0.0/24
2 (lan1) to (amplia) source static |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclSrcNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 destination static |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 |s2sAclDestNwgV4|14c46a12-c3d6-11f1-9f75-03f216e5c322 no-proxy-arp route-lookup
translate_hits = 0, untranslate_hits = 0
Source - Origin: 192.168.75.0/24, Translated: 192.168.75.0/24
Destination - Origin: 192.168.0.0/24, Translated: 192.168.0.0/24

Manual NAT Policies (Section 3)
1 (lan1) to (amplia) source dynamic any-ipv4 interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 0.0.0.0/0, Translated: XXX.XXX.131.178/30
2 (lan1) to (digicel) source dynamic any-ipv4 interface
translate_hits = 8092, untranslate_hits = 300
Source - Origin: 0.0.0.0/0, Translated: XXX.XXX.38.131/32