0

I've setup some static nat entries in an ASA 5505. If I ping the external ip, the response I get back is the internal ip address...

Example:

$ping 12.12.12.4
PING 12.12.12.4 (12.12.12.4): 56 data bytes
64 bytes from 10.10.3.4: icmp_seq=0 ttl=125 time=1.342 ms

12.12.12.4 is the external ip and 10.10.3.4 is the internal ip of the host.

The asa has the following static nat entry:

static (inside,outside) 12.12.12.4 10.10.3.4 netmask 255.255.255.255

Is there anything I can be missing that would cause this?

Improve this question
3
  • You don't mention where you are pinging from, but I suspect it is inside the firewall with the 10.10.3.4 device (or your gateway for the two networks is between the devices and the ASA). You usually see this behavior because your outgoing ping goes to the NAT device which modifies the dstIP and sends it there. The receiving device then sees that the srcIP of the host is on the local network (or the gateway does so) and responds directly, and not through the NAT devices.
    – YLearn
    Oct 10, 2013 at 19:12
  • Hi Ylearn, I'm pinging from a different server on a different subnet. I'm not pinging from within the firewall.
    – Network Samurai
    Oct 10, 2013 at 19:46
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 8, 2017 at 14:58

1 Answer 1

Reset to default
1

From the look of it, you want to translate incoming packets originating from the 12.12.12.4 address, so that they appear to have the source address of the internal IP 10.10.3.4.

The syntax for this command is:

static (outside,inside) 10.10.3.4 12.12.12.4 netmask 255.255.255.255

Source: Cisco ASA 5500 Series Configuration Guide Using CLI 8.2 - Configuring Static NAT http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_static.html#wp1080960

Improve this answer
2
  • Apologies - there is no "Add Comment" button beneath the original post for me (probably because my rep is too low).
    – Panther Modern
    Oct 11, 2013 at 22:55
  • Not a problem and thank you for the edit. Commenting anywhere requires 50 reputation in beta, which isn't too hard to achieve.
    – YLearn
    Oct 12, 2013 at 1:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.