I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ASA v9.8.


You can find that out by using the packet-tracer feature. To use it from the CLI, you would issue the command:

packet-tracer input <name of your source interface > <protocol> <source IP address> <source port> <destination IP address> <destination port>

In the results, you will see each phase the traffic is subjected to. One of those phases will show you which NAT statement your traffic is hitting.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.