VPN NAT Issue

[vince.elentrio1]

Hello all,

Receiving error:

I am natting on my side only to a public IP NAT address of 147.140.208.11. Does the tunnel need to be up for this to work? I tested this in the lab and it worked as I was able to ping 147.140.208.11.

5

Feb 21 2017

08:25:15

147.140.23.101

172.16.210.203

Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src Partner-Int:147.140.23.101 dst Partner-Ext:172.16.210.203 (type 8, code 0) denied due to NAT reverse path failure

How to i fix this?

SA Version 9.2(2)4 <context>

!

hostname RestricetedPartner

enable password 8Ry2YjIyt7RRXU24 encrypted

names

!

interface GigabitEthernet0/1

nameif Partner-Ext

security-level 0

ip address 147.140.23.101 255.255.255.0 standby 147.140.23.106

!

interface GigabitEthernet0/3

nameif Partner-Int

security-level 100

ip address 147.140.22.51 255.255.255.0 standby 147.140.22.52

!

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network lab-target

host 172.20.10.11

object network Nat1

host 147.140.208.11

object network Rothman-Source

host 172.16.210.203

object network Rothman-Nat-Pool

subnet 147.140.208.0 255.255.255.248

access-list VPN_Rothman extended permit ip host 10.187.126.21 host 172.16.210.203

pager lines 24

logging enable

logging asdm informational

mtu Partner-Ext 1500

mtu Partner-Int 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

nat (Partner-Ext,Partner-Int) source static Rothman-Source Nat1

route Partner-Ext 0.0.0.0 0.0.0.0 147.140.23.12 1

route Partner-Int 10.160.0.0 255.224.0.0 147.140.22.12 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

user-identity default-domain LOCAL

snmp-server group nmSr3ad v3 priv

snmp-server user nmSr3ad nmSr3ad v3 encrypted auth sha 26:2a:9f:c0:61:52:b1:9d:92:99:a2:9a:ea:78:08:a6:af:9f:3f:d2 priv des db:77:1e:ea:cc:d9:aa:ab:ed:00:cf:6c:50:21:e8:bd:cd:22:5a:39

snmp-server host Partner-Int 10.184.23.70 version 3 nmSr3ad

no snmp-server location

no snmp-server contact

crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac

crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac

crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport

crypto ipsec ikev1 transform-set Outside_Comcast esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set VPN_Test esp-aes-256 esp-sha-hmac

crypto ipsec ikev1 transform-set VPN_Rothman esp-aes-256 esp-sha-hmac

crypto ipsec ikev2 ipsec-proposal DES

protocol esp encryption des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal 3DES

protocol esp encryption 3des

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES

protocol esp encryption aes

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES192

protocol esp encryption aes-192

protocol esp integrity sha-1 md5

crypto ipsec ikev2 ipsec-proposal AES256

protocol esp encryption aes-256

protocol esp integrity sha-1 md5

crypto ipsec security-association pmtu-aging infinite

crypto map VPN_Partner 2 match address VPN_Rothman

crypto map VPN_Partner 2 set peer 107.0.63.3

crypto map VPN_Partner 2 set ikev1 transform-set VPN_Rothman

crypto map VPN_Partner interface Partner-Ext

crypto ikev2 policy 1

encryption aes-256

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 2

encryption 3des

integrity sha

group 5 2

prf md5

lifetime seconds 86400

crypto ikev2 policy 10

encryption aes-192

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 20

encryption aes

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 30

encryption 3des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev2 policy 40

encryption des

integrity sha

group 5 2

prf sha

lifetime seconds 86400

crypto ikev1 enable Partner-Ext

crypto ikev1 enable Partner-Int

crypto ikev1 policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto ikev1 policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto ikev1 policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto ikev1 policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto ikev1 policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

no ssh stricthostkeycheck

ssh timeout 5

ssh key-exchange group dh-group1-sha1

no threat-detection statistics tcp-intercept

tunnel-group 70.91.19.126 type ipsec-l2l

tunnel-group 70.91.19.126 ipsec-attributes

ikev1 pre-shared-key *****

tunnel-group 107.0.63.3 type ipsec-l2l

tunnel-group 107.0.63.3 ipsec-attributes

ikev1 pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

Cryptochecksum:b2d0c2a707d2681837cd0d5c52b94093

: end

[Francesco Molino]

Hi

If I would like to understand something.
The source Rothman-Source is coming from Internet and you want it natted on 1 of your own public pool IP?

If yes, you are facing an asymmetric routing issue.

Before giving you some hints on configuration, could you explain a bit more what you really want to achieve?

I'm asking that because I see that you have a VPN with something that has the same name and I bet it's not a coincidence.

thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[vince.elentrio1]

Hi Francesco,

Yes on you first point. We want to NAT Rothman with a public pool. We would like to hide everything behind that 147.140.208.11.Rothman will only see there 172.16.x.x and when the traffic comes back to be natted back. This is on our DMZ. No natting with take place on the Rothman side.

Thanks

[Francesco Molino]

If it's 1 IP to nat into 1 other IP when reaching your LAN, you can use the following command:

nat (inside,outside) source static  RealobjectIP MappedObject destination static LAN LAN

Thanks

[vince.elentrio1]

Thanks how  does this look?

(Partner-Int) to (Partner-Ext) source static Nat1 Rothman-Source   destination static Rothman-Source Rothman-Source
    translate_hits = 1, untranslate_hits = 2

[Francesco Molino]

Sorry for the late answer. I was at work.

I'm reviewing your config through my phone while getting back home :-)

The command I gave you was an example and in your case is in the wrong way.

The Rothman source should only access your internal device 10.187.126.2, right ?

You want that this source while accessing your machine is natted, right?

Your source Rothman object is Rothman-Source
Your NAT object is Nat1
Your destination machine isn't created yet. Let's assume you have object called dst for destination IP 10.187.126.2.

The config would looks like:

nat (outside,inside) source static Rothman-Source Nat1 destination static dst dst no-proxy-arp

Thanks

PS: Please don't forget to rate and mark as correct answer if this answered your question

[jfalzoneCORP]

Francesco Molino,

I have no way to send you an email or post something to you. pls help with this question:

I have four c240s  mx4 with two power supplies each.

they have been in production for about a year.

here are trhe serial #s:
FCH1937V31G  mgmt portal: 

10.15.80.21

FCH1937V34H 

10.15.80.24

FCH1937V37T

10.15.80.22

FCH1936V1PN

10.15.80.23

. do you need the make and model of the power supplies?

firmware is 2.0(6) 
The Power supply fans are not spinning at all; not over heating and per the validation tool, not part any known PSU issues.

do i need to be concerned?

[Francesco Molino]

Hi,

sorry but you should create a specific post for your issue. I'm not able to answer your question as I don't have a lot of knowledge on the UCS part.

Sorry for that.

[vince.elentrio1]

Hi Francesco,

Have you a chance to look at my configuration?