2

I've changed our Watchguard XTM firewall for Cisco ASA 5508-x, all seems to be working but do have one problem though... The nat / pat connections from the outside stop working.

We have a single external IP address, and so use effectively port forwarding to open firewall to the servers. The connections are fine from inside, but not from the internet.

If I do a "clear arp" on the firewall, the connections start working again for a while...

I disabled the secondary firewall.

On some servers, there were two nic's connected without any teaming software, so I've removed the second cable.

I've rebooted the servers but still get the issue...

Any thoughts?

Here's an example of the nat config for a connection to a servers port 80 using port 90 on the outside

object network Server1_90 host 192.168.1.66

access-list OUTSIDE extended permit tcp any object Server1_90 eq www

object network Server1_90 nat (inside,EXT_PUB_INT) static interface service tcp www 90

0

Looks like a duplicate IP issue to me. Is outbound traffic working fine when your servers are not reachable from the Internet?

  • There are some devices that work on out bound traffic and some that do not. It's a massive /17 subnet completely flat too that I've inherited... – Neil Frost Oct 10 '15 at 14:03
  • Found someone had put a wireless access point on the network somewhere... – Neil Frost Oct 11 '15 at 14:13
  • Did the AP act as a DHCP server? If yes, you may want to look at DHCP snooping, which may be enabled on your switches to block DHCP replies from untrusted ports. – kaisero Oct 11 '15 at 14:44
0

Since you are using interface MNAT, it may be proxy arp issue.. Can you share the output of command below:

show running-config sysopt
  • This is the only command in that section sysopt connection timewait – Neil Frost Oct 10 '15 at 14:09
  • Sysopt proxy arp is enabled by default and those commands will not be shown in running-config. Can you try this command.. show running-config all | I sysopt – G K Oct 10 '15 at 14:22
  • Also if possible, check for duplicate ARP for single MAC.. – G K Oct 10 '15 at 14:25
  • I've looked at the arp table and there are no duplicates. It's exhibitting the issue at the moment too. – Neil Frost Oct 10 '15 at 14:45
  • no sysopt traffic detailed-statistics sysopt connection timewait sysopt connection tcpmss 1380 sysopt connection tcpmss minimum 0 sysopt connection permit-vpn sysopt connection reclassify-vpn no sysopt connection preserve-vpn-flows no sysopt radius ignore-secret no sysopt noproxyarp EXT_PUB_INT no sysopt noproxyarp DMZ_INT no sysopt noproxyarp inside no sysopt noproxyarp PUB_DMZ_INT no sysopt noproxyarp PUB_OSZ_INT no sysopt noproxyarp PUB_ISZ_INT no sysopt noproxyarp CUS_DMZ_INT no sysopt noproxyarp management – Neil Frost Oct 10 '15 at 14:53
0

Found the issue...

Someone had put a wireless access point somewhere with the same IP address as the inside of the firewall

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.