How to check/control which NAT & ACL rule(s) has been hit?

[IamSamSaul]

Hi there,

Is there any command (CLI or GUI) to check or control which NAT rule has been hit? 

For example: a user is coming from Internet and wants to access a webserver in DMZ zone. Now I would like to know which NAT rule and ACL rule(s) has been hit during this connection.

Thanks & Regards,

Sam

[Rob Ingram]

Hi @IamSamSaul 

Yes, you can run packet-tracer from the CLI or ASDM, this will simulate traffic. In the output you can determine which NAT rule and ACL was matched. E.g.

packet-tracer input <source interface> <protocol> <source IP> <source port> <destination IP> <destination port> [detailed]

HTH

[IamSamSaul]

Hi Rob, 

Thanks for your reply. I was using the same command in FTD's CLI (system support diagnostic-cli) but it does not show the NAT section.

This is the situation:

Client - Inside - DMZ - Webserver 

I have a NAT exempt rule from Client to Webserver. 

Is it possible that I don't see the NAT hit in my capture due to this rule? 

I was using the following capture command:

capture CAP1 interface DMZ trace detailed match ip host 10.10.20.34 host 172.16.1.100

Webserver: 172.16.1.100

Client: 10.10.20.34

Thanks. 

[Rob Ingram · Accepted solution]

@IamSamSaul 

No, packet-tracer would still display the output if you hit a NAT exemption rule. It's more likely that traffic didn't match any NAT rule.

Run the command "show nat detail" from the CLI and determine whether there were actually any hits on that NAT exemption rule.

HTH

[balaji.bandi]

use PT as described below :

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/116388-technote-nat-00.html#anc4