4

I am seeing the following messages in my ASA Log files:

2015-09-10T14:22:07.860487-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30
2015-09-10T14:22:07.860487-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30
2015-09-10T14:22:07.860491-05:00 natbox %ASA-2-106006: Deny inbound UDP from 172.17.136.168/16403 to 172.17.136.168/16403 on interface Outside_128.255.2.116/30

The 172.17.128.0/17 network should be internal (on the inside interface of the NAT box) and not appear on the Outside Interface.

Here are the NAT statements from the config:

object network WLAN_USR_GLOBAL_POOL_129_255_228_0
 range 129.255.228.10 129.255.231.254

object network ARUBA_LOCAL_172_17_128_0
  subnet 172.17.128.0 255.255.128.0

object network ARUBA_LOCAL_172_17_128_0
  nat (any,any) dynamic pat-pool WLAN_USR_GLOBAL_POOL_129_255_228_0 round-robin

UPDATE: I executed a small packet capture on the outgoing interface of the ASA and I'm not seeing any traffic from 172.17.128.0/17. So I suspect something else.

Update Simplified Diagram:

Diagram

Traffic to the Internet follows the wireless routers default route to the ASA to be NAT'd.

Traffic to internal networks is routed by more specific routes directly to the core router.

Update 2015-09-15 The Cisco TAC recommended that I specify the source and destination interfaces rather than (any,any), so I did that. It did not make a difference.

Thanks.

4
  • 1
    Do you have a NAT statement for that ip address?
    – HAL
    Sep 10, 2015 at 19:40
  • 1
    It could be useful to provide relevant parts of your configuration.
    – Teun Vink
    Sep 10, 2015 at 22:55
  • Edited to add NAT Statement Sep 11, 2015 at 13:50
  • A network diagram would help. What is the outside connection plugged into? A modem/router directly or a switch? If a switch, do any internal devices connect to it as well? You might have VLANs misconfigured if so. Sep 11, 2015 at 16:01

1 Answer 1

1

It turns out that for some reason inside hosts where trying to talk to other inside hosts using their public IP. We suspect some sort of service where the public IP is registered.

To prevent the traffic from reaching the ASA we put a routing statement to black-hole traffic coming from the inside to outside addresses.

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.