Asymmetric NAT rules denied due to NAT reverse path failure

[hicklingp23]

We have a site to site VPN where all traffic from the remote site is tunneled over the VPN so internet access goes through our ASA (running code 9.1), this traffic hairpins in and out the same (outside) interface.

The VPN is up and working fine, I can ping devices on the remote side no problem from an internal device on our side, but when trying to ping the an external IP from a PC on the remote side I'm seeing "Asymmetric NAT rules denied due to NAT reverse path failure" in the logs, so this to me means the traffic is traversing the VPN tunnel but NAT is then getting in the way, the NAT config is;

NoNat Statement for the encryption domain - nat (inside,outside) source static OBJGRP-FOR-VPN OBJGRP-FOR-VPN destination static OBJ-192.168.xxx.xxx_27 OBJ-192.168.xxx.xxx_27 no-proxy-arp route-lookup where OBJGRP-FOR-VPN are all internal IP addresses

Dynamic NAT - object network OBJ-NAT_CATCH_ALL
                              nat (any,outside) dynamic 37.xxx.xxx.xxx where OBJ-NAT_Catch_all is subnet 0.0.0.0 0.0.0.0

Thanks in advance.

[Bogdan Nita]

NAT RPF checks that the traffic forwarded using a nat rule will use the same rule when returning.

I am guessing you have another nat rule configured which is causing you problems.

You should check the other rules configured, also you can try to change the nat rules order using the seq number. (by default manual NATs come before the object NAT).

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc8

https://supportforums.cisco.com/t5/security-documents/asa-nat-8-3-nat-operation-and-configuration-format-cli/ta-p/3143050

HTH

Bogdan

[hicklingp23]

Thanks Bogdan, all other auto NAT statements are inside or dmz to outside so don't thinks they'd conflict and there is an outside to outside manual NAT statement but that only NATs the remote access VPN IP pool which is on a different IP range to the remote IP range of the L2L VPN.

Any other ideas?

Cheers 

[hicklingp23]

Also when I do a show xlate is see entries for the remote side IP addresses NAT'd to the external IP of the correct (Catch all) NAT statement.