How do I find out which NAT is getting hit?

Question

I can see in packet captures that my packet's destination IP is getting translated. How do I find which NAT statement is responsible for the conversion if my device has over 200 NAT rules? I'm using ASA v9.8.

Answer 1

You can find that out by using the packet-tracer feature. To use it from the CLI, you would issue the command:

packet-tracer input <name of your source interface > <protocol> <source IP address> <source port> <destination IP address> <destination port>

In the results, you will see each phase the traffic is subjected to. One of those phases will show you which NAT statement your traffic is hitting.