How to assign a second available Public ip for NAT (Dynamic PAT) to Inside Network Cisco ASA 5516-X

Question

I have a x.x.x.200/29 subnet of Public IPs.

Router Interface: x.x.x.206 255.255.255.248
ASA 5516-x outside: x.x.x.201 255.255.255.248
ASA 5516-x Inside: 10.111.22.254 255.255.255.0

I want to nat all my inside interface traffic to x.x.x.205 Ip address.

a busy cat

Router Config:

interface GigabitEthernet180/1/0/40
 description fw Gi1/2 Inside
 switchport
 switchport trunk allowed vlan 1
 switchport mode access
 switchport access vlan 100
 switchport port-security violation restrict
 switchport port-security aging type inactivity
 no logging event link-status
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 ip dhcp snooping limit rate 10
end

interface GigabitEthernet180/1/0/41
 description fw Gi1/1 Outside
 switchport
 switchport trunk allowed vlan 1
 switchport mode access
 switchport access vlan 99
 switchport port-security violation restrict
 switchport port-security aging type inactivity
 no logging event link-status
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 ip dhcp snooping limit rate 10
end

interface Vlan99
 name fw Outside
 ip address x.x.x.206 255.255.255.248
 description fw Outside
 exit

vlan 100       
 name "fw Inside"
 exit

Here is ASA sh run confing:

interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address x.x.x.201 255.255.255.248
 !
 interface GigabitEthernet1/2
 description "Inside"
 nameif inside
 security-level 100
 ip address 10.111.22.254 255.255.255.0

Nat Config:

object network Nat-xx-205
 subnet 10.111.22.0 255.255.255.0
object network Public_outside
 host x.x.x.x.205
 description Public Outside IP

Access List

 access-list acl_out extended permit icmp any4 any4 echo-reply
 access-list acl_out extended permit icmp any4 any4 source-quench
 access-list acl_out extended permit icmp any4 any4 unreachable
 access-list acl_out extended permit icmp any4 any4 time-exceeded
 access-list acl_out extended permit udp object-group dance any4 eq snmp
 access-list acl_out extended permit icmp object-group dance any4
 access-list inside_access_in extended permit ip any any

 mtu outside 1500
 mtu inside 1500 
 ip verify reverse-path interface outside
 ip verify reverse-path interface inside

 nat (inside,outside) after-auto source dynamic Nat-xx-205 Public_outside
 access-group acl_out in interface outside
 access-group inside_access_in in interface inside
 route outside 0.0.0.0 0.0.0.0 .x.x.x.206 1


 dhcpd address 10.111.22.1-10.111.22.253 inside
 dhcpd dns x.x.22.60 x.x.22.62 interface inside
 dhcpd lease 300 interface inside
 dhcpd enable inside


class-map inspection_default
 match default-inspection-traffic
 !
 !
 policy-map type inspect dns preset_dns_map
 parameters
 message-length maximum client auto
 message-length maximum 1300
 no tcp-inspection
 policy-map global_policy
 class inspection_default
 inspect dns preset_dns_map
 inspect ftp
 inspect h323 h225
 inspect h323 ras
 inspect rsh
 inspect rtsp
 inspect esmtp
 inspect sqlnet
 inspect skinny
 inspect sunrpc
 inspect xdmcp
 inspect sip
 inspect netbios
 inspect tftp
 inspect ip-options

May be i am wrong configured, Please help me to fix the 2nd available Public IP for Nat on Inside network.

Thanks in advance.

Packet Tracer

fw# packet-tracer input inside tcp 10.111.22.10 56789 8.8.8.8 443
Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop x.x.x.206 using egress ifc  outside

Phase: 2
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 10.111.22.10 using egress ifc  inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:

Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) after-auto source dynamic Nat-xx-205 Public_outside
Additional Information:
Dynamic translate 10.111.22.10/56789 to x.x.x.205/56789

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,outside) after-auto source dynamic Nat-xx-205 Public_outside
Additional Information:

Phase: 8
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 34702, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

fw# sh logging | i 10.111.22.13
 Teardown UDP connection 18078 for outside:130.83.22.62/53 to inside:10.111.22.13/57559 duration 0:02:07 bytes 141
Mar 02 2018 12:58:14: %ASA-6-302016: Teardown UDP connection 18075 for outside:8.8.8.8/53 to inside:10.111.22.13/57559 duration 0:02:08 bytes 188
Mar 02 2018 12:58:14: %ASA-6-305012: Teardown dynamic UDP translation from inside:10.111.22.13/57559 to outside:X.X.X.205/57559 duration 0:02:08
Mar 02 2018 12:58:15: %ASA-6-302016: Teardown UDP connection 18086 for outside:8.8.8.8/53 to inside:10.111.22.13/52482 duration 0:02:03 bytes 96
Mar 02 2018 12:58:15: %ASA-6-302016: Teardown UDP connection 18089 for outside:130.83.22.62/53 to inside:10.111.22.13/56808 duration 0:02:01 bytes 47
Mar 02 2018 12:58:15: %ASA-6-305012: Teardown dynamic UDP translation from inside:10.111.22.13/52482 to outside:X.X.X.205/52482 duration 0:02:03
Mar 02 2018 12:58:16: %ASA-6-302016: Teardown UDP connection 18087 for outside:8.8.8.8/53 to inside:10.111.22.13/56808 duration 0:02:03 bytes 94
Mar 02 2018 12:58:16: %ASA-6-302016: Teardown UDP connection 18090 for outside:8.8.8.8/53 to inside:10.111.22.13/54385 duration 0:02:01 bytes 42
Mar 02 2018 12:58:16: %ASA-6-305012: Teardown dynamic UDP translation from inside:10.111.22.13/56808 to outside:X.X.X.205/56808 duration 0:02:03
Mar 02 2018 12:58:16: %ASA-6-305012: Teardown dynamic UDP translation from inside:10.111.22.13/54385 to outside:X.X.X.205/54385 duration 0:02:01
Mar 02 2018 12:58:16: %ASA-7-609002: Teardown local-host inside:10.111.22.13 duration 0:03:01
fw#

fw# show capture asp-drop

 50: 12:46:40.626493       221.226.82.226.5104 > X.X.X.201.5060:  udp 412 Drop-reason: (acl-drop) Flow is denied by configured rule

  51: 12:48:07.739936       116.21.88.116.15000 > X.X.X.201.45139:  udp 20 Drop-reason: (acl-drop) Flow is denied by configured rule

  52: 12:48:07.760031       116.21.88.116.15000 > X.X.X.201.45139:  udp 114 Drop-reason: (acl-drop) Flow is denied by configured rule

  53: 12:48:07.760382       116.21.88.116.15000 > X.X.X.201.45139:  udp 20 Drop-reason: (acl-drop) Flow is denied by configured rule

  54: 12:48:09.781774       116.21.88.116.15000 > X.X.X.201.45139:  udp 114 Drop-reason: (acl-drop) Flow is denied by configured rule

  55: 12:48:13.794743       116.21.88.116.15000 > X.X.X.201.45139:  udp 114 Drop-reason: (acl-drop) Flow is denied by configured rule

  56: 12:48:21.818332       116.21.88.116.15000 > X.X.X.201.45139:  udp 114 Drop-reason: (acl-drop) Flow is denied by configured rule

  57: 12:48:28.583176       5.101.40.48.56539 > X.X.X.201.46791: S 1576709658:1576709658(0) win 1024 Drop-reason: (acl-drop) Flow is denied by configured rule

  58: 12:50:57.464636       109.248.9.18.46061 > X.X.X.201.13403: S 3931032209:3931032209(0) win 1024 Drop-reason: (acl-drop) Flow is denied by configured rule

  59: 12:51:15.630140       181.128.5.172.40668 > X.X.X.201.23: S 2249883442:2249883442(0) win 38613 Drop-reason: (acl-drop) Flow is denied by configured rule


fw# cap capin interface inside real-time

Warning: using this option with a slow console connection may
         result in an excessive amount of non-displayed packets
         due to performance limitations.

Use ctrl-c to terminate real-time capture


 67: 12:45:32.501011       10.111.22.13 > 8.8.8.8: icmp: echo request
  68: 12:45:32.700983       10.111.22.13.57394 > 8.8.8.8.53:  udp 58
  69: 12:45:32.700998       10.111.22.13.62577 > 8.8.8.8.53:  udp 58
  70: 12:45:33.240984       10.111.22.13.53046 > 8.8.8.8.53:  udp 43
  71: 12:45:33.780950       10.111.22.13.56683 > 8.8.8.8.53:  udp 34
  72: 12:45:34.011016       10.111.22.13.55006 > 8.8.8.8.53:  udp 42
  73: 12:45:34.052319       10.111.22.13.61513 > 8.8.8.8.53:  udp 42
  74: 12:45:35.111017       10.111.22.13.55682 > 8.8.8.8.53:  udp 45
  75: 12:45:35.380870       10.111.22.13.64752 > 8.8.8.8.53:  udp 45
  76: 12:45:36.050992       10.111.22.13.61513 > 8.8.8.8.53:  udp 42
  77: 12:45:36.381022       10.111.22.13.59965 > 8.8.8.8.53:  udp 45
  78: 12:45:36.459265       10.111.22.13.56933 > 8.8.8.8.53:  udp 47
  79: 12:45:36.701028       10.111.22.13.62577 > 8.8.8.8.53:  udp 58
  80: 12:45:36.701044       10.111.22.13.57394 > 8.8.8.8.53:  udp 58
  81: 12:45:36.751410       10.111.22.13.55956 > 8.8.8.8.53:  udp 55
  82: 12:45:37.241061       10.111.22.13.53046 > 8.8.8.8.53:  udp 43
  83: 12:45:37.501057       10.111.22.13 > 8.8.8.8: icmp: echo request
  84: 12:45:37.780980       10.111.22.13.56683 > 8.8.8.8.53:  udp 34
  85: 12:45:38.051053       10.111.22.13.61513 > 8.8.8.8.53:  udp 42
  86: 12:45:38.450995       10.111.22.13.56933 > 8.8.8.8.53:  udp 47
  87: 12:45:38.750998       10.111.22.13.55956 > 8.8.8.8.53:  udp 55
  88: 12:45:39.062344       10.111.22.13.50905 > 8.8.8.8.53:  udp 42
  89: 12:45:40.382197       10.111.22.13.59598 > 8.8.8.8.53:  udp 45
  90: 12:45:40.451056       10.111.22.13.56933 > 8.8.8.8.53:  udp 47
  91: 12:45:40.751044       10.111.22.13.55956 > 8.8.8.8.53:  udp 55
  92: 12:45:41.061032       10.111.22.13.50905 > 8.8.8.8.53:  udp 42
  93: 12:45:41.241610       10.111.22.13.59419 > 8.8.8.8.53:  udp 43
  94: 12:45:41.242373       10.111.22.13.63309 > 8.8.8.8.53:  udp 43
  95: 12:45:41.782094       10.111.22.13.62649 > 8.8.8.8.53:  udp 35
  96: 12:45:42.051068       10.111.22.13.61513 > 8.8.8.8.53:  udp 42
  97: 12:45:42.381053       10.111.22.13.59598 > 8.8.8.8.53:  udp 45
  98: 12:45:43.060894       10.111.22.13.50905 > 8.8.8.8.53:  udp 42
  99: 12:45:43.241045       10.111.22.13.63309 > 8.8.8.8.53:  udp 43
 100: 12:45:43.241091       10.111.22.13.59419 > 8.8.8.8.53:  udp 43
 101: 12:45:43.781011       10.111.22.13.62649 > 8.8.8.8.53:  udp 35
 102: 12:45:44.001113       10.111.22.13.61752 > 8.8.8.8.53:  udp 45
 103: 12:45:44.291809       10.111.22.13 > X.X.X.201: icmp: echo request
 104: 12:45:44.381083       10.111.22.13.59598 > 8.8.8.8.53:  udp 45
 105: 12:45:44.451179       10.111.22.13.56933 > 8.8.8.8.53:  udp 47
 106: 12:45:44.751105       10.111.22.13.55956 > 8.8.8.8.53:  udp 55
 107: 12:45:45.001068       10.111.22.13.61752 > 8.8.8.8.53:  udp 45
 108: 12:45:45.071132       10.111.22.13.49824 > 8.8.8.8.53:  udp 45
 109: 12:45:45.241076       10.111.22.13.59419 > 8.8.8.8.53:  udp 43
 110: 12:45:45.241122       10.111.22.13.63309 > 8.8.8.8.53:  udp 43
 111: 12:45:45.781072       10.111.22.13.62649 > 8.8.8.8.53:  udp 35
 112: 12:45:46.071087       10.111.22.13.49824 > 8.8.8.8.53:  udp 45
 113: 12:45:46.261125       10.111.22.13.62787 > 8.8.8.8.53:  udp 48
 114: 12:45:47.001098       10.111.22.13.61752 > 8.8.8.8.53:  udp 45
 115: 12:45:47.051129       10.111.22.13.62200 > 8.8.8.8.53:  udp 42
 116: 12:45:47.061077       10.111.22.13.50905 > 8.8.8.8.53:  udp 42
 117: 12:45:47.261079       10.111.22.13.62787 > 8.8.8.8.53:  udp 48
 118: 12:45:48.051099       10.111.22.13.62200 > 8.8.8.8.53:  udp 42
 119: 12:45:48.071148       10.111.22.13.49824 > 8.8.8.8.53:  udp 45
 120: 12:45:48.381099       10.111.22.13.59598 > 8.8.8.8.53:  udp 45
 121: 12:45:48.691126       10.111.22.13.51262 > 8.8.8.8.53:  udp 50
 122: 12:45:49.001174       10.111.22.13 > X.X.X.201: icmp: echo request
 123: 12:45:49.241137       10.111.22.13.59419 > 8.8.8.8.53:  udp 43
 124: 12:45:49.241167       10.111.22.13.63309 > 8.8.8.8.53:  udp 43
 125: 12:45:49.261110       10.111.22.13.62787 > 8.8.8.8.53:  udp 48
 126: 12:45:49.691080       10.111.22.13.51262 > 8.8.8.8.53:  udp 50
 127: 12:45:49.781087       10.111.22.13.62649 > 8.8.8.8.53:  udp 35
 128: 12:45:49.951122       10.111.22.13.64903 > 8.8.8.8.53:  udp 47
 129: 12:45:50.051144       10.111.22.13.62200 > 8.8.8.8.53:  udp 42
 130: 12:45:50.951076       10.111.22.13.64903 > 8.8.8.8.53:  udp 47
 131: 12:45:51.001144       10.111.22.13.61752 > 8.8.8.8.53:  udp 45
 132: 12:45:51.691248       10.111.22.13.51262 > 8.8.8.8.53:  udp 50
 133: 12:45:51.751166       10.111.22.13.52300 > 8.8.8.8.53:  udp 53
 134: 12:45:52.061169       10.111.22.13.57546 > 8.8.8.8.53:  udp 42
 135: 12:45:52.071163       10.111.22.13.49824 > 8.8.8.8.53:  udp 45
 136: 12:45:52.751136       10.111.22.13.52300 > 8.8.8.8.53:  udp 53
 137: 12:45:52.951137       10.111.22.13.64903 > 8.8.8.8.53:  udp 47
 138: 12:45:53.061108       10.111.22.13.57546 > 8.8.8.8.53:  udp 42
 139: 12:45:53.261155       10.111.22.13.62787 > 8.8.8.8.53:  udp 48
 140: 12:45:54.001251       10.111.22.13 > X.X.X.201: icmp: echo request
 141: 12:45:54.051190       10.111.22.13.62200 > 8.8.8.8.53:  udp 42
 142: 12:45:54.241167       10.111.22.13.62793 > 8.8.8.8.53:  udp 43
 143: 12:45:54.241366       10.111.22.13.50398 > 8.8.8.8.53:  udp 45
 144: 12:45:54.751181       10.111.22.13.52300 > 8.8.8.8.53:  udp 53
 145: 12:45:55.061001       10.111.22.13.57546 > 8.8.8.8.53:  udp 42
 146: 12:45:55.241152       10.111.22.13.50398 > 8.8.8.8.53:  udp 45
 147: 12:45:55.241198       10.111.22.13.62793 > 8.8.8.8.53:  udp 43
 148: 12:45:55.691324       10.111.22.13.51262 > 8.8.8.8.53:  udp 50
 149: 12:45:56.951183       10.111.22.13.64903 > 8.8.8.8.53:  udp 47
 150: 12:45:57.241198       10.111.22.13.50398 > 8.8.8.8.53:  udp 45
 151: 12:45:57.241228       10.111.22.13.62793 > 8.8.8.8.53:  udp 43
 152: 12:45:57.261812       10.111.22.13.55743 > 8.8.8.8.53:  udp 48
 153: 12:45:58.051694       10.111.22.13.64847 > 8.8.8.8.53:  udp 43
 154: 12:45:58.751181       10.111.22.13.52300 > 8.8.8.8.53:  udp 53
 155: 12:45:59.001281       10.111.22.13 > X.X.X.201: icmp: echo request
 156: 12:45:59.061169       10.111.22.13.57546 > 8.8.8.8.53:  udp 42
 157: 12:45:59.261201       10.111.22.13.55743 > 8.8.8.8.53:  udp 48
 158: 12:46:00.051205       10.111.22.13.64847 > 8.8.8.8.53:  udp 43
 159: 12:46:01.241259       10.111.22.13.62793 > 8.8.8.8.53:  udp 43
 160: 12:46:01.241290       10.111.22.13.50398 > 8.8.8.8.53:  udp 45
 161: 12:46:01.261216       10.111.22.13.55743 > 8.8.8.8.53:  udp 48
 162: 12:46:01.452155       10.111.22.13.56590 > 8.8.8.8.53:  udp 47
 163: 12:46:01.484319       10.111.22.13.50446 > 8.8.8.8.53:  udp 45
 164: 12:46:02.051266       10.111.22.13.64847 > 8.8.8.8.53:  udp 43
 165: 12:46:02.751654       10.111.22.13.64981 > 8.8.8.8.53:  udp 55
 166: 12:46:03.451179       10.111.22.13.56590 > 8.8.8.8.53:  udp 47
 167: 12:46:03.481176       10.111.22.13.50446 > 8.8.8.8.53:  udp 45
 168: 12:46:04.751242       10.111.22.13.64981 > 8.8.8.8.53:  udp 55
 169: 12:46:05.241763       10.111.22.13.65118 > 8.8.8.8.53:  udp 43
 170: 12:46:05.261262       10.111.22.13.55743 > 8.8.8.8.53:  udp 48
 171: 12:46:05.451285       10.111.22.13.56590 > 8.8.8.8.53:  udp 47
 172: 12:46:05.481237       10.111.22.13.50446 > 8.8.8.8.53:  udp 45
 173: 12:46:06.051282       10.111.22.13.64847 > 8.8.8.8.53:  udp 43
 174: 12:46:06.751273       10.111.22.13.64981 > 8.8.8.8.53:  udp 55
 175: 12:46:07.241274       10.111.22.13.65118 > 8.8.8.8.53:  udp 43
 176: 12:46:09.241335       10.111.22.13.65118 > 8.8.8.8.53:  udp 43
 177: 12:46:09.266801       10.111.22.13.55921 > 8.8.8.8.53:  udp 48
 178: 12:46:09.451285       10.111.22.13.56590 > 8.8.8.8.53:  udp 47
 179: 12:46:09.481267       10.111.22.13.50446 > 8.8.8.8.53:  udp 45
 180: 12:46:10.751319       10.111.22.13.64981 > 8.8.8.8.53:  udp 55
 181: 12:46:11.261323       10.111.22.13.55921 > 8.8.8.8.53:  udp 48
 182: 12:46:13.241335       10.111.22.13.65118 > 8.8.8.8.53:  udp 43
 183: 12:46:13.261323       10.111.22.13.55921 > 8.8.8.8.53:  udp 48
 184: 12:46:13.481756       10.111.22.13.59164 > 8.8.8.8.53:  udp 45
 185: 12:46:13.482107       10.111.22.13.53797 > 8.8.8.8.53:  udp 45
 186: 12:46:13.952160       10.111.22.13.62157 > 8.8.8.8.53:  udp 47
 187: 12:46:14.388209       10.111.22.13 > X.X.X.206: icmp: echo request
 188: 12:46:15.125008       10.111.22.13.54169 > 8.8.8.8.53:  udp 46
 189: 12:46:15.481298       10.111.22.13.59164 > 8.8.8.8.53:  udp 45
 190: 12:46:15.481344       10.111.22.13.53797 > 8.8.8.8.53:  udp 45
 191: 12:46:15.951321       10.111.22.13.62157 > 8.8.8.8.53:  udp 47
 192: 12:46:17.121346       10.111.22.13.54169 > 8.8.8.8.53:  udp 46
 193: 12:46:17.242541       10.111.22.13.57573 > 8.8.8.8.53:  udp 43
 194: 12:46:17.261369       10.111.22.13.55921 > 8.8.8.8.53:  udp 48
 195: 12:46:17.481359       10.111.22.13.59164 > 8.8.8.8.53:  udp 45
 196: 12:46:17.481389       10.111.22.13.53797 > 8.8.8.8.53:  udp 45
 197: 12:46:17.951366       10.111.22.13.62157 > 8.8.8.8.53:  udp 47
 198: 12:46:19.001495       10.111.22.13 > X.X.X.206: icmp: echo request
 199: 12:46:19.121407       10.111.22.13.54169 > 8.8.8.8.53:  udp 46
 200: 12:46:19.241381       10.111.22.13.57573 > 8.8.8.8.53:  udp 43
 201: 12:46:21.241412       10.111.22.13.57573 > 8.8.8.8.53:  udp 43
 202: 12:46:21.265473       10.111.22.13.61086 > 8.8.8.8.53:  udp 48
 203: 12:46:21.481389       10.111.22.13.59164 > 8.8.8.8.53:  udp 45
 204: 12:46:21.481420       10.111.22.13.53797 > 8.8.8.8.53:  udp 45
 205: 12:46:21.951412       10.111.22.13.62157 > 8.8.8.8.53:  udp 47
 206: 12:46:23.121453       10.111.22.13.54169 > 8.8.8.8.53:  udp 46
 207: 12:46:23.261400       10.111.22.13.61086 > 8.8.8.8.53:  udp 48
 208: 12:46:24.001556       10.111.22.13 > X.X.X.206: icmp: echo request
 209: 12:46:25.241473       10.111.22.13.57573 > 8.8.8.8.53:  udp 43
 210: 12:46:25.261339       10.111.22.13.61086 > 8.8.8.8.53:  udp 48
 211: 12:46:25.481939       10.111.22.13.53331 > 8.8.8.8.53:  udp 45
 212: 12:46:26.452292       10.111.22.13.57053 > 8.8.8.8.53:  udp 47
 213: 12:46:27.122506       10.111.22.13.53358 > 8.8.8.8.53:  udp 46
 214: 12:46:27.481405       10.111.22.13.53331 > 8.8.8.8.53:  udp 45
 215: 12:46:28.451423       10.111.22.13.57053 > 8.8.8.8.53:  udp 47
 216: 12:46:29.001556       10.111.22.13 > X.X.X.206: icmp: echo request
 217: 12:46:29.121453       10.111.22.13.53358 > 8.8.8.8.53:  udp 46
 218: 12:46:29.241930       10.111.22.13.59809 > 8.8.8.8.53:  udp 43
 219: 12:46:29.242251       10.111.22.13.60172 > 8.8.8.8.53:  udp 43
 220: 12:46:29.261476       10.111.22.13.61086 > 8.8.8.8.53:  udp 48
 221: 12:46:29.481450       10.111.22.13.53331 > 8.8.8.8.53:  udp 45
 222: 12:46:30.451468       10.111.22.13.57053 > 8.8.8.8.53:  udp 47
 223: 12:46:31.121468       10.111.22.13.53358 > 8.8.8.8.53:  udp 46
 224: 12:46:31.241442       10.111.22.13.60172 > 8.8.8.8.53:  udp 43
 225: 12:46:31.241488       10.111.22.13.59809 > 8.8.8.8.53:  udp 43
 226: 12:46:31.534777       10.111.22.13.57850 > 8.8.8.8.53:  udp 45
 227: 12:46:32.914839       10.111.22.13.63295 > 8.8.8.8.53:  udp 58
 228: 12:46:33.241518       10.111.22.13.59809 > 8.8.8.8.53:  udp 43
 229: 12:46:33.241534       10.111.22.13.60172 > 8.8.8.8.53:  udp 43
 230: 12:46:33.287811       10.111.22.13.53859 > 8.8.8.8.53:  udp 58
 231: 12:46:33.481496       10.111.22.13.53331 > 8.8.8.8.53:  udp 45
 232: 12:46:33.531527       10.111.22.13.57850 > 8.8.8.8.53:  udp 45
 233: 12:46:34.451529       10.111.22.13.57053 > 8.8.8.8.53:  udp 47
 234: 12:46:34.793934       10.111.22.13.63860 > 8.8.8.8.53:  udp 50
 235: 12:46:34.911482       10.111.22.13.63295 > 8.8.8.8.53:  udp 58
 236: 12:46:35.121560       10.111.22.13.53358 > 8.8.8.8.53:  udp 46
 237: 12:46:35.281494       10.111.22.13.53859 > 8.8.8.8.53:  udp 58
 238: 12:46:35.531542       10.111.22.13.57850 > 8.8.8.8.53:  udp 45
 239: 12:46:36.791493       10.111.22.13.63860 > 8.8.8.8.53:  udp 50
 240: 12:46:36.911543       10.111.22.13.63295 > 8.8.8.8.53:  udp 58
 241: 12:46:37.241579       10.111.22.13.60172 > 8.8.8.8.53:  udp 43
 242: 12:46:37.241595       10.111.22.13.59809 > 8.8.8.8.53:  udp 43
 243: 12:46:37.281555       10.111.22.13.53859 > 8.8.8.8.53:  udp 58
 244: 12:46:38.259843       10.111.22.13.57560 > 8.8.8.8.53:  udp 58
 245: 12:46:38.791539       10.111.22.13.63860 > 8.8.8.8.53:  udp 50
 246: 12:46:38.952434       10.111.22.13.56613 > 8.8.8.8.53:  udp 47
 247: 12:46:39.531603       10.111.22.13.57850 > 8.8.8.8.53:  udp 45
 248: 12:46:40.251543       10.111.22.13.57560 > 8.8.8.8.53:  udp 58
 249: 12:46:40.911573       10.111.22.13.63295 > 8.8.8.8.53:  udp 58
 250: 12:46:40.951519       10.111.22.13.56613 > 8.8.8.8.53:  udp 47
 251: 12:46:41.242129       10.111.22.13.50156 > 8.8.8.8.53:  udp 43
 252: 12:46:41.281601       10.111.22.13.53859 > 8.8.8.8.53:  udp 58
 253: 12:46:42.251573       10.111.22.13.57560 > 8.8.8.8.53:  udp 58
 254: 12:46:42.791585       10.111.22.13.63860 > 8.8.8.8.53:  udp 50
 255: 12:46:42.951580       10.111.22.13.56613 > 8.8.8.8.53:  udp 47
 256: 12:46:43.241564       10.111.22.13.50156 > 8.8.8.8.53:  udp 43
 257: 12:46:44.001617       10.111.22.13.57638 > 8.8.8.8.53:  udp 45
 258: 12:46:44.531603       10.111.22.13.59669 > 8.8.8.8.53:  udp 45
 259: 12:46:44.531802       10.111.22.13.49900 > 8.8.8.8.53:  udp 45
 260: 12:46:45.001586       10.111.22.13.57638 > 8.8.8.8.53:  udp 45
 261: 12:46:45.241640       10.111.22.13.50156 > 8.8.8.8.53:  udp 43
 262: 12:46:45.531573       10.111.22.13.59669 > 8.8.8.8.53:  udp 45
 263: 12:46:45.531619       10.111.22.13.49900 > 8.8.8.8.53:  udp 45
 264: 12:46:46.251634       10.111.22.13.57560 > 8.8.8.8.53:  udp 58
 265: 12:46:46.951626       10.111.22.13.56613 > 8.8.8.8.53:  udp 47
 266: 12:46:47.001632       10.111.22.13.57638 > 8.8.8.8.53:  udp 45
 267: 12:46:47.531634       10.111.22.13.59669 > 8.8.8.8.53:  udp 45
 268: 12:46:47.531665       10.111.22.13.49900 > 8.8.8.8.53:  udp 45
268 packets shown.
0 packets not shown due to performance limitations.

Mashhood Ahmad · Accepted Answer · 2018-03-20 11:52:16Z

2

I figured out the problem, I ranout the following command and everything worked perfectly as desired.

no sysopt noproxyarp outside

answered Mar 20, 2018 at 11:52

Mashhood Ahmad

416 bronze badges

1

Good to hear that! :) However, by default, that command should be always there unless someone does the difference.
– Hung Tran
Commented Mar 20, 2018 at 13:00

Add a comment |

Hung Tran · Accepted Answer · 2018-02-28 15:10:43Z

I can see a typo in the object-group you used for NAT configuration - Nat-x-205. The correct one should be Nat-xx-205with double xx.

Your following DHCP range is also not correct - 10.111.22.1 - 10.111.22.253. The correct range should be 10.111.20.1 - .253, and we need to setroute for this DHCP range.

 dhcpd address 10.111.22.1-10.111.22.253 inside
 dhcpd dns x.x.22.60 x.x.22.62 interface inside

Please run the following packet-tracer command and update your question with the output:

packet-tracer input inside tcp 10.111.20.10 56789 8.8.8.8 443

Updated answer:

Please try to simplify the configuration on Cat 6807 (Router) as below:

interface GigabitEthernet180/1/0/40
 description fw Gi1/2 Inside
 switchport
 switchport mode access
 switchport access vlan 100
 no logging event link-status
 spanning-tree portfast edge
 spanning-tree bpduguard enable
 ip dhcp snooping limit rate 10
end
!
interface GigabitEthernet180/1/0/41
 description fw Gi1/1 Outside
 switchport
 switchport mode access
 switchport access vlan 99
 no logging event link-status
 spanning-tree portfast edge
 spanning-tree bpduguard enable
end

At the same time, please turn on your capture on ASA as below (I assume you have a real host with IP address 10.111.22.10, if not please change the following IP to correct one)

capture IN interface inside match ip host 10.111.22.5 any

Then test the real Internet traffic from 10.111.22.5, and while testing this, please frequently check the connections and NAT information on ASA by using the following commands:

show conn | i 10.111.22.5

show xlate local 10.111.22.5

Please let me know the result of those tests and commands.

@MashhoodAhmad Yes, packet-tracer tells us everything is fine at Firewall, but we still see how the traffic passes through other devices. — Hung Tran, Commented Feb 28, 2018 at 8:56
I can ping 10.111.22.254 from 10.111.22.5 but i can not ping to x.x.x.201, 206 or 205 as well. — Mashhood Ahmad, Commented Feb 28, 2018 at 12:36
@MashhoodAhmad Do you have default gateway configured or assigned on inside host (like 10.111.22.5)? The default gateway should be your Firewall inside IP .22.254. And you should test to ping the Cat 6807 IP address x.x.x.206 only! — Hung Tran, Commented Feb 28, 2018 at 13:26
Yes, i have inside default gateway 10.111.22.254, for that it works from 10.111.22.5 but from 10.111.22.5 i can not ping firewall gateway in that case x.x.x.206. — Mashhood Ahmad, Commented Feb 28, 2018 at 13:59
When i use nat(inside,outside) dynamic interface everything works fine,,, but it goes out with x.x.x.201 as public IP. That i don't want. I want when it goes out it should take x.x.x.205 as public IP. Is there ACL is missing ??? Any Idea ?? — Mashhood Ahmad, Commented Feb 28, 2018 at 14:29

Stack Exchange Network

How to assign a second available Public ip for NAT (Dynamic PAT) to Inside Network Cisco ASA 5516-X

2 Answers 2

Updated answer:

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco-asa
firewall
nat
or ask your own question.

Hot Network Questions

How to assign a second available Public ip for NAT (Dynamic PAT) to Inside Network Cisco ASA 5516-X

2 Answers 2

Updated answer:

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco-asafirewallnat or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco-asa
firewall
nat
or ask your own question.