NAT not translating private addresses

[raphaeloester]

Hello, 

Well everything is in the title. My ASA doesn't translate the IP address when i try to ping a router in the external network.

Here's my topology and my ASA configuration.

EDIT : I tried to ping the same router from my DHCP server, which is in the vlan 1, directly connected to my multilayyer switch (netword 192.168.1.0/24). Turns out these precise icmp packages get translated as expected.

Now i compared the asa configurations between vlan 1 and vlans 10,20,30, and i can't spot any difference, so really i don't get it.

EDIT 2 : Screen capture below !!

: Saved

:

ASA Version 8.4(2)

!

hostname ciscoasa

names

!

interface Ethernet0/0

!

interface Ethernet0/1

switchport access vlan 2

!

interface Ethernet0/2

switchport access vlan 3

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.254 255.255.255.0

!

interface Vlan2

no forward interface Vlan1

nameif dmz

security-level 70

ip address 192.168.0.14 255.255.255.240

!

interface Vlan3

nameif outside

security-level 0

ip address 200.0.0.1 255.255.255.248

!

object network dmz-server

host 192.168.0.5

object network inside-net

subnet 192.168.1.0 255.255.255.0

object network inside-net-vlan10

subnet 192.168.10.0 255.255.255.0

object network inside-net-vlan20

subnet 192.168.20.0 255.255.255.0

object network inside-net-vlan30

subnet 192.168.30.0 255.255.255.0

!

route inside 192.168.10.0 255.255.255.0 0.0.0.0 1

route inside 192.168.20.0 255.255.255.0 0.0.0.0 1

route inside 192.168.30.0 255.255.255.0 0.0.0.0 1

route outside 0.0.0.0 0.0.0.0 200.0.0.2 1

!

access-list OUTSIDE-DMZ extended permit tcp any host 192.168.0.5 eq www

access-list OUTSIDE-DMZ extended permit icmp any host 192.168.0.5

!

!

access-group OUTSIDE-DMZ in interface outside

object network dmz-server

nat (dmz,outside) static 200.0.0.1

object network inside-net

nat (inside,outside) dynamic interface

object network inside-net-vlan10

nat (inside,outside) dynamic interface

object network inside-net-vlan20

nat (inside,outside) dynamic interface

object network inside-net-vlan30

nat (inside,outside) dynamic interface

!

!

!

!

!

!

!

telnet timeout 5

ssh timeout 5

!

dhcpd address 192.168.1.5-192.168.1.36 inside

dhcpd enable inside

!

!

!

!

!

[Karsten Iwen]

How did you come to the conclusion that the ASA does not translate the IPs? Based on the config I would assume that it should work.

The most likely problem is that the testing approach is wrong:

• Did you use Ping to test? Then make sure that the ASA is configured with ICMP statefully. Make sure that the destination is answering the request
• Testing from the ASA? You should not see a translation as the ASA uses the outside IP and there is no need to translate

EDIT: The internal static routes are likely incorrect. And I just saw the picture, this is in a simulation? Then I would always consider that there could be a bug in that. Look if the "packet-tracer"-command is available and simulate with that.

[raphaeloester]

I assume that as you now have looked at the image, all your questions have found an answer. In the outbound pdu details tab, i can see that the SRC IP adress is still the local one. 

What is that packet-tracer command you just mentionned ? Where should i execute it, in order to do what ?

Thanks

[balaji.bandi]

I may be missed some information here

NAT not translating private addresses

is this from DMZ to Internal ?

or outside to Internal ?

or outside to DMZ ?

[raphaeloester]

Hello, it is a ping from internal to outside. See capture attached to topic

[balaji.bandi]

if inside to outside try below:

(config)# policy-map global_policy
(config-pmap)# class inspection_default
(config-pmap-c)# inspect icmp
(config-pmap-c)# exit
(config-pmap)# exit

here packet tracer to test :

https://community.cisco.com/t5/security-documents/troubleshooting-access-problems-using-packet-tracer/ta-p/3114976

[raphaeloester]

The problem doesn't come from the access list. The packet can go through the firewall, it's only the src IP address that isn't translated. See capture attached to this message.

[raphaeloester · Accepted solution]

Ok this doesn't make any **bleep** sense.

Finally found a solution, i post it there in case the same bug happens to someone else.

Don't look for any logic behind it, i guess the problem was just CPT related.

On the ASA, for each network whose addresses you want to translate : 

• Access the corresponding network object 
• nat (inside,outside) static x.x.x.x <-- [outside ip here]
• try to ping outside the network, it should NOT work
• now set back the nat in dynamic mode with nat (inside,outside) dynamic interface

Once you've done this on all the network objects, everything should work as expected. Hope this helps, hope a CPT developper sees this and decides to fix it.