Cisco ASA NAT issue

[Tejas Kunte]

i have an ASA setup as follows

         10.11.34.1 (Mgmt)----ASA----(Production) 10.11.35.1

both interfaces are at security level 100

i have setup a NAT policy so that if 10.11.34.15 wants to talk to 10.11.35.239 or 10.11.35.240 source IP is NATed to 172.21.34.15

this is the NAT statement is have 

nat (Mgmt,Production) source static ECW17MGMT001 RP_NAT destination static RP RP

the setup is not working

if i do a packet trace from 10.11.34.15 to 10.11.35.239 it completes

 if i reverse it from 35.239 to 34.15 it fails (says Action-DROP) in the NAT section

i have verified that no ACLs applied to the interfaces are blocking any traffic

[Karsten Iwen]

Is it only packet-tracer that gives an error? And what is your exact command for packet-tracer? You have to use the translated address (172.21.34.15) as the destination in packet-tracer.

[piyush.dhupia]

Hi Tejas Kunte,

if your asa image is latest(after9.1) then you must to use original ip not natted IP.

you can use PAT and allow complete network and under access list define the acl.

hope it work

regards,

Piyush