1

As I was writing this down I think the solution came to me. As usual.

I'll write this down nevertheless to make the world a better place. =D

Let's take a look at this beauty of a network diagram :

enter image description here

So we have two daisy-chained ASAs and up to and including interface "outside2" all have PUBLIC IP addresses. Software is ASA 9.8 on ASA1, which this is about.

The problem is that without the identity NAT statement

nat (inside1,outside1) source static netx netx unidirectional

where netx = 1.1.1.240/29 (the network between the two ASAs), traffic does not seem to flow correctly in one of the directions at least. (Currently, I can't be more specific because I don't know exactly.) Since the private address space is PATed behind ASA2, the result is no connectivity to the Internet at all.

There is no specific routing entry on ASA1 to reach ASA2 since these networks are directly attached. ASA1 is the default route for ASA2. Also, all these interfaces have ACLs that correctly permit traffic so security levels are of no concern here. There is also no other NAT statement with (inside1,outside1) interface selection. There is no NAT statement with "any" interface whatsoever that could conflict.

The funny thing is that after removing the NAT statement in question (followed by "clear xlate"), it still takes hours for the actual Internet access to become unavailable. However, putting it back instantly resolves the problem.

I would like to understand why it seems this NAT statement is needed. (I thought the days of "NAT control", where you needed NAT statements even if nothing needed translating, were long gone...)

Improve this question
6
  • Would you please update your ASA1 and ASA2 configuration?
    – Hung Tran
    Commented Dec 29, 2017 at 23:36
  • Since the private address space is PATed behind ASA2, the result is no connectivity to the Internet at all How does this NAT statement look like? And is there any reason of why you use public IP addresses for network between ASA2 and ASA1?
    – Hung Tran
    Commented Dec 29, 2017 at 23:38
  • 1) Nope, can't give out the entire config like that. 2) Since it is PATed, a failing interlink will make the entire network go offline. There's no mystery there. 3) The public adresses are there, we have to live with them. :)
    – Marki
    Commented Dec 30, 2017 at 0:40
  • BTW see my own answer as I suggested :)
    – Marki
    Commented Dec 30, 2017 at 0:40
  • Good to hear that you could solve it. Otherwise, I do not think anyone would be able to help, given that no detailed information and configuration were provided at all.
    – Hung Tran
    Commented Dec 30, 2017 at 11:39

1 Answer 1

Reset to default
2

It looks like indeed the NAT statement in itself is not needed, however proxy ARP is needed here. Having that identity NAT implicitly activates proxy ARP (even if ASDM warns you not to do that). But in this case you have to.

Feel free to correct me if you think the answer/solution is wrong.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.