I've setup some static nat entries in an ASA 5505. If I ping the external ip, the response I get back is the internal ip address...


PING ( 56 data bytes
64 bytes from icmp_seq=0 ttl=125 time=1.342 ms is the external ip and is the internal ip of the host.

The asa has the following static nat entry:

static (inside,outside) netmask 

Is there anything I can be missing that would cause this?

  • You don't mention where you are pinging from, but I suspect it is inside the firewall with the device (or your gateway for the two networks is between the devices and the ASA). You usually see this behavior because your outgoing ping goes to the NAT device which modifies the dstIP and sends it there. The receiving device then sees that the srcIP of the host is on the local network (or the gateway does so) and responds directly, and not through the NAT devices.
    – YLearn
    Oct 10, 2013 at 19:12
  • Hi Ylearn, I'm pinging from a different server on a different subnet. I'm not pinging from within the firewall. Oct 10, 2013 at 19:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 8, 2017 at 14:58

1 Answer 1


From the look of it, you want to translate incoming packets originating from the address, so that they appear to have the source address of the internal IP

The syntax for this command is:

static (outside,inside) netmask

Source: Cisco ASA 5500 Series Configuration Guide Using CLI 8.2 - Configuring Static NAT http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html#wp1080960

  • Apologies - there is no "Add Comment" button beneath the original post for me (probably because my rep is too low). Oct 11, 2013 at 22:55
  • Not a problem and thank you for the edit. Commenting anywhere requires 50 reputation in beta, which isn't too hard to achieve.
    – YLearn
    Oct 12, 2013 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.