Solved: NAT issue ton VPN - Page 2

Olivier Chambelant · ‎08-01-2016

Hello dudes

I have a problem with a VPN.

Here the architecture:

10.91.250.16 <<<<>>>> ASA <<<<>>>> TUNNEL<<<<>>>> CHECKPOINT <<<<>>>> 172.16.8.12

Before to enter in tunnel 10.91.250.16 is nated to 10.10.249.1.

When I try to ping, I get this error message:

5

Aug 01 2016

11:07:50

305013

10.91.250.16

172.16.8.12

Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp src inside:10.91.250.16 dst outside:172.16.8.12 (type 8, code 0) denied due to NAT reverse path failure

I'll attach my configuration.

Thanks for your help

Olivier Chambelant · ‎08-01-2016

Ok, I done a mistake:

 show run nat
nat (inside,outside) source static HOST_CAMPUS_LISSES_SERVEURS_ERPVIRTUEL NAT_CAMPUS<->CUSTOMER destination static LAN_CUSTOMER LAN_CUSTOMER
!
object network obj_any
 nat (any,inside) dynamic interface
!
nat (MANAGEMENT,outside) after-auto source dynamic any interface

show run nat
nat (inside,outside) source static HOST_SOLUTYS_LISSES_SERVEURS_SAGEVIRTUEL NAT_SOLUTYS<->SAMSE destination static LAN_SAMSE LAN_SAMSE
!
object network obj_any
 nat (any,inside) dynamic interface
!
nat (MANAGEMENT,outside) after-auto source dynamic any interface
Venus# packet-tracer input inside icmp 10.91.250.16 8 0 172.16.8.12 det

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 88.164.214.254 using egress ifc outside

Phase: 2
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in id=0x2aaac04fedd0, priority=0, domain=nat-per-session, deny=true
 hits=891766, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
 input_ifc=any, output_ifc=any

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in id=0x2aaac0fba920, priority=0, domain=inspect-ip-options, deny=true
 hits=51943, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
 input_ifc=inside, output_ifc=any

Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
 match default-inspection-traffic
policy-map global_policy
 class inspection_default
 inspect icmp
service-policy global_policy global
Additional Information:
 Forward Flow based lookup yields rule:
 in id=0x2aaac1c6ee80, priority=70, domain=inspect-icmp, deny=false
 hits=2721, user_data=0x2aaac2d393e0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=any, dscp=0x0
 input_ifc=inside, output_ifc=any

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in id=0x2aaac0fba130, priority=66, domain=inspect-icmp-error, deny=false
 hits=6139, user_data=0x2aaac0fb96a0, cs_id=0x0, use_real_addr, flags=0x0, protocol=1
 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=any, dscp=0x0
 input_ifc=inside, output_ifc=any

Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in id=0x2aaac1c79750, priority=13, domain=ipsec-tunnel-flow, deny=true
 hits=3718, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0
 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
 input_ifc=inside, output_ifc=any

Phase: 7
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
object network obj_any
 nat (any,inside) dynamic interface
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x2aaac10cd210, priority=6, domain=nat-reverse, deny=false
 hits=3857, user_data=0x2aaac10cb390, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
 input_ifc=inside, output_ifc=any

Result:
output-interface: outside
output-status: up
output-line-status: up
Action: drop

Thanks a lot for your help !!!

Olivier.

Dina Odeh · ‎08-01-2016

Hi,

We have an issue with Destination NAT here. If your destination IP "172.16.8.12" should be the same then it is better to have a static NAT on ASA as follow:

nat (inside,outside) source static HOST_CAMPUS_LISSES_SERVEURS_ERPVIRTUEL NAT_CAMPUS<->CUSTOMER destination static obj-172.16.8.12 obj-172.16.8.12

Create please an object for this IP: 172.16.8.12