cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
262
Views
0
Helpful
0
Replies
Highlighted

NAT-Divert Use Cases

Hi there,

 

I am trying to understand some use cases for NAT-Divert. Can it be used to override the routing table? Let me give an example of a case here.

 

Let's say I have 3 interfaces, inside, outside, outside2. I only want a specific network from the inside network to use the secondary internet connection which is outside2. Removing NAT in the picture and just pure NAT-Divert and Routing.

 

object network vlan100

 subnet 100.0.0.0 255.255.255.0

 

object network any2

 subnet 0.0.0.0 0.0.0.0

 

nat (inside,outside2) source static vlan100 vlan100 destination static any2 any2

 

route outside 0.0.0.0 0.0.0.0 101.0.0.1

 

So my default route is pointing to outside for all other traffic. If I try to establish connectivity from vlan100 to any IP, I can see that the firewall is creating a conduit for inside,outside2 pair. That means the firewall is trying to send the traffic out to outside2 interface using NAT-divert. However, traffic fails because of this error.

 

ASA-6-110003: Routing failed to locate next hop

 

I understand that it's failing because it cannot locate the next-hop IP and MAC address.

 

Without using PBR on Cisco ASA, can NAT-divert work in this scenario?

 

By the way, I tried to manually map an ARP entry to see if this will work. Let's say I tried to ping 1.2.3.4 from VLAN100. I can see the conduit created on the session table as inside,outside2 but packet capture do not see traffic coming out of the outside2 interface. So I tried to map 1.2.3.4 to let's say the MAC address of the possible next-hop of outside2. The ASA-6-110003 error from the logs disappeared but still not traffic being released to outside.

 

Any thoughts?