0

I've setup some static nat entries in an ASA 5505. If I ping the external ip, the response I get back is the internal ip address...

Example:

$ping 12.12.12.4
PING 12.12.12.4 (12.12.12.4): 56 data bytes
64 bytes from 10.10.3.4: icmp_seq=0 ttl=125 time=1.342 ms

12.12.12.4 is the external ip and 10.10.3.4 is the internal ip of the host.

The asa has the following static nat entry:

static (inside,outside) 12.12.12.4 10.10.3.4 netmask 255.255.255.255 

Is there anything I can be missing that would cause this?

3
  • You don't mention where you are pinging from, but I suspect it is inside the firewall with the 10.10.3.4 device (or your gateway for the two networks is between the devices and the ASA). You usually see this behavior because your outgoing ping goes to the NAT device which modifies the dstIP and sends it there. The receiving device then sees that the srcIP of the host is on the local network (or the gateway does so) and responds directly, and not through the NAT devices. – YLearn Oct 10 '13 at 19:12
  • Hi Ylearn, I'm pinging from a different server on a different subnet. I'm not pinging from within the firewall. – Network Samurai Oct 10 '13 at 19:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 14:58
1

From the look of it, you want to translate incoming packets originating from the 12.12.12.4 address, so that they appear to have the source address of the internal IP 10.10.3.4.

The syntax for this command is:

static (outside,inside) 10.10.3.4 12.12.12.4 netmask 255.255.255.255

Source: Cisco ASA 5500 Series Configuration Guide Using CLI 8.2 - Configuring Static NAT http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html#wp1080960

2
  • Apologies - there is no "Add Comment" button beneath the original post for me (probably because my rep is too low). – Panther Modern Oct 11 '13 at 22:55
  • Not a problem and thank you for the edit. Commenting anywhere requires 50 reputation in beta, which isn't too hard to achieve. – YLearn Oct 12 '13 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.