2

I've changed our Watchguard XTM firewall for Cisco ASA 5508-x, all seems to be working but do have one problem though... The nat / pat connections from the outside stop working.

We have a single external IP address, and so use effectively port forwarding to open firewall to the servers. The connections are fine from inside, but not from the internet.

If I do a "clear arp" on the firewall, the connections start working again for a while...

I disabled the secondary firewall.

On some servers, there were two nic's connected without any teaming software, so I've removed the second cable.

I've rebooted the servers but still get the issue...

Any thoughts?

Here's an example of the nat config for a connection to a servers port 80 using port 90 on the outside

object network Server1_90 host 192.168.1.66

access-list OUTSIDE extended permit tcp any object Server1_90 eq www

object network Server1_90 nat (inside,EXT_PUB_INT) static interface service tcp www 90

3 Answers 3

Reset to default
0

Looks like a duplicate IP issue to me. Is outbound traffic working fine when your servers are not reachable from the Internet?

3
  • There are some devices that work on out bound traffic and some that do not. It's a massive /17 subnet completely flat too that I've inherited...
    – Neil Frost
    Commented Oct 10, 2015 at 14:03
  • Found someone had put a wireless access point on the network somewhere...
    – Neil Frost
    Commented Oct 11, 2015 at 14:13
  • Did the AP act as a DHCP server? If yes, you may want to look at DHCP snooping, which may be enabled on your switches to block DHCP replies from untrusted ports.
    – kaisero
    Commented Oct 11, 2015 at 14:44
0

Since you are using interface MNAT, it may be proxy arp issue.. Can you share the output of command below:

show running-config sysopt
18
  • This is the only command in that section sysopt connection timewait
    – Neil Frost
    Commented Oct 10, 2015 at 14:09
  • Sysopt proxy arp is enabled by default and those commands will not be shown in running-config. Can you try this command.. show running-config all | I sysopt
    – G K
    Commented Oct 10, 2015 at 14:22
  • Also if possible, check for duplicate ARP for single MAC..
    – G K
    Commented Oct 10, 2015 at 14:25
  • I've looked at the arp table and there are no duplicates. It's exhibitting the issue at the moment too.
    – Neil Frost
    Commented Oct 10, 2015 at 14:45
  • no sysopt traffic detailed-statistics sysopt connection timewait sysopt connection tcpmss 1380 sysopt connection tcpmss minimum 0 sysopt connection permit-vpn sysopt connection reclassify-vpn no sysopt connection preserve-vpn-flows no sysopt radius ignore-secret no sysopt noproxyarp EXT_PUB_INT no sysopt noproxyarp DMZ_INT no sysopt noproxyarp inside no sysopt noproxyarp PUB_DMZ_INT no sysopt noproxyarp PUB_OSZ_INT no sysopt noproxyarp PUB_ISZ_INT no sysopt noproxyarp CUS_DMZ_INT no sysopt noproxyarp management
    – Neil Frost
    Commented Oct 10, 2015 at 14:53
0

Found the issue...

Someone had put a wireless access point somewhere with the same IP address as the inside of the firewall

0

This site is temporarily in read-only mode and not accepting new answers.

Not the answer you're looking for? Browse other questions tagged .