Nating is not working

[Amardeep Kumar]

Hi

Cisco asa was running in my network. I powered it off and put another firewall ( Barracuda)  with same configuration same IP. 

it was running perfectly. Now I have removed Barrcuda and power on cisco. But not natting from cisco is not working. servers are not accessible from outside.

Thanks

Amar

[balaji.bandi]

Good, we would like to know - how are you configured ASA, what is the ASA model and Code running inside ASA.

Give us more information to understand your problem, there is always a solution, ASA tested many people tested and working ASA NAT.

So post below information :

1. Show run 

2. show version

3. what is the IP address you try to nat, what is not working? going to the internet ?

[Amardeep Kumar]

CiscoASA# sh run
: Saved

:
: Serial Number: JAD221009QY
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.8(2)
!
hostname CiscoASA
enable password $sha512$5000$f+kzIxcfeSQulmc3Dtv/jQ==$EH4AmR07iOkj2yXYoPnrYQ== pbkdf2
names
ip local pool remote-vpn 192.168.39.100-192.168.39.200 mask 255.255.255.0
ip local pool Remotebackup 192.168.37.100-192.168.37.200 mask 255.255.255.0

!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address 12.133.76.130 255.255.255.240
!
interface GigabitEthernet1/2
nameif outside2
security-level 0
ip address 50.192.171.25 255.255.255.248
!
interface GigabitEthernet1/3
bridge-group 1
nameif inside_2
security-level 100
!
interface GigabitEthernet1/4
bridge-group 1
nameif inside_3
security-level 100
!
interface GigabitEthernet1/5
bridge-group 1
nameif inside_4
security-level 100
!
interface GigabitEthernet1/6
bridge-group 1
nameif inside_5
security-level 100
!
interface GigabitEthernet1/7
description TestInterface
nameif inside7
security-level 100
ip address 192.168.8.254 255.255.255.0
!
interface GigabitEthernet1/8
nameif inside1
security-level 100
ip address 192.168.3.254 255.255.255.0
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
interface BVI1
nameif inside
security-level 10
ip address 192.168.1.1 255.255.255.0
!
banner motd Welcome to Chetu Inc.
ftp mode passive
clock timezone GMT 0
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
name-server 4.2.2.2
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network URbkupSVR-out
host 12.133.76.133
object network URbkupSVR-in
host 192.168.3.48
object network CRM-Svr-out
host 12.133.76.134
object network CRM-Svr-in
host 192.168.3.41

access-list 10 extended permit icmp any any echo-reply
access-list 10 extended permit icmp any any unreachable
access-list 10 extended permit icmp any any time-exceeded
access-list 10 extended permit icmp any any
access-list 10 extended permit tcp any object URbkupSVR-in eq 55415
access-list 10 extended permit tcp any object CRM-Svr-in eq www
access-list 10 extended permit tcp any object CRM-Svr-in eq https
access-list outside_cryptomap_4 extended permit ip object NETWORK_OBJ_192.168.3.0_24 object-group A186-All-floors+DMZ
access-list outside_cryptomap_4 extended permit ip object Plant-Network object India-VPNuser
access-list Plan-vpn_splitTunnelAcl standard permit 192.168.3.0 255.255.255.0

access-list Remote-Backup_splitTunnelAcl standard permit 192.168.3.0 255.255.255.0
access-list outside_cryptomap_1 extended permit ip 192.168.3.0 255.255.255.0 object Floor154
access-list outside_cryptomap_1 extended permit ip 192.168.3.0 255.255.255.0 object Floor154-FF
access-list outside_cryptomap_1 extended permit ip 192.168.3.0 255.255.255.0 object H06-LGF
access-list Newvpn_splitTunnelAcl standard permit 192.168.3.0 255.255.255.0
access-list outside_cryptomap extended permit ip 192.168.3.0 255.255.255.0 object NETWORK_OBJ_192.168.25.0_24
pager lines 24
logging asdm informational
mtu outside 1500
mtu outside2 1500
mtu inside_2 1500
mtu inside_3 1500
mtu inside_4 1500
mtu inside_5 1500
mtu inside7 1500
mtu inside1 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside1,outside) source static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 destination static NETWORK_OBJ_192.168.39.0_24 NETWORK_OBJ_192.168.39.0_24 no-proxy-arp route-lookup
nat (inside1,outside) source static NETWORK_OBJ_192.168.3.0_24 NETWORK_OBJ_192.168.3.0_24 destination static H06-LGF H06-LGF no-proxy-arp route-lookup
!
object network obj_any2
nat (inside_2,outside) dynamic interface
object network obj_any3
nat (inside_3,outside) dynamic interface
object network obj_any4
nat (inside_4,outside) dynamic interface
object network obj_any5
nat (inside_5,outside) dynamic interface
object network URbkupSVR-in
nat (inside1,outside) static URbkupSVR-out
object network Plant-Network
nat (inside1,outside) dynamic interface
object network CRM-Svr-in
nat (inside1,outside) static CRM-Svr-out
!
nat (inside1,outside2) after-auto source dynamic any interface
access-group 10 in interface outside
access-group 11 in interface outside2
route outside 0.0.0.0 0.0.0.0 12.133.76.129 1 track 100
route outside2 0.0.0.0 0.0.0.0 50.192.171.30 2
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication telnet console LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside_2
http 192.168.1.0 255.255.255.0 inside_3
http 192.168.1.0 255.255.255.0 inside_4
http 192.168.1.0 255.255.255.0 inside_5
http 192.168.3.0 255.255.255.0 inside1
http 182.74.233.26 255.255.255.255 outside
http 192.168.8.0 255.255.255.0 inside7
http 182.74.233.26 255.255.255.255 outside2
http 103.42.91.34 255.255.255.255 outside
snmp-server host inside1 192.168.12.30 community ***** version 2c
snmp-server location Florida
snmp-server contact itsupport@chetu.com
snmp-server community *****
sla monitor 1
type echo protocol ipIcmpEcho 4.2.2.2 interface outside
num-packets 3
frequency 10
sla monitor schedule 1 life forever start-time now
service sw-reset-button

crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal India-2
protocol esp encryption aes-192 3des
protocol esp integrity sha-256 sha-1

!
class-map inspection_default
!
!
policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:2a7d878e2f9b4533e0bae777523b6604
: end
CiscoASA#

nattin not working 

12.133.76.143 Public IP 

192.168.3.41 local Ip  

[Amardeep Kumar]

(config)# show version

Cisco Adaptive Security Appliance Software Version 9.8(2)
Firepower Extensible Operating System Version 2.2(2.52)
Device Manager Version 7.8(2)

Compiled on Sun 27-Aug-17 13:06 PDT by builders
System image file is "disk0:/asa982-lfbff-k8.SPA"
Config file at boot was "startup-config"

PlantationDataASA up 1 hour 34 mins

Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
Internal ATA Compact Flash, 8000MB
BIOS Flash M25P64 @ 0xfed01000, 16384KB

Encryption hardware device : Cisco ASA Crypto on-board accelerator (revision 0x1)
Number of accelerators: 1

[Georg Pauwen]

Hello,

have you tried to clear the NAT translations on the ASA ?

clear xlate

[Amardeep Kumar]

yes, I tried Xlate many times. but not working.

[Georg Pauwen]

Hello,

looking at your configuration, I don't see the network object 'NETWORK_OBJ_192.168.3.0_24' which is referenced in your access lists and your NAT statements. Try and add the below:

object network NETWORK_OBJ_192.168.3.0_24
subnet 192.168.3.0 255.255.255.0
nat (inside1, outside) dynamic interface

[balaji.bandi]

You have some inside interface, from which interface you are tried and not working.

As suggested @Georg Pauwen  you need to have match ip address in the group object for NAT to work.

change accordingly for each inside interface try and let us know.

[Amardeep Kumar]

I did nothing. It started after some time itself. 

Still known. 

BTW thanks everyone for your time

Thanks

Amardeep 

[balaji.bandi · Accepted solution]

Glad all working as expected, can we mark as solution here, if the issue resolved.