2

I have a Twice NAT routing question. How do I forward an IP packet based on the pre-translated destination? Right now I have conflicting subnets between two sites which is why I am doing the Twice NAT. However, I believe the Cisco ASA is routing based on the post-translated address and therefore not forwarding the packet in the correct direction.

Here's my code

interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address 10.10.201.1 255.255.255.0
interface GigabitEthernet3
 nameif outside
 security-level 0
 ip address 10.255.255.1 255.255.255.252

object network SideA-PC_real
 host 10.10.17.55
object network SideA-PC_map
 host 10.252.28.55
object network SideB-PC_real
 host 10.10.17.155
object network SideB-PC_map
 host 10.251.4.155

route outside 10.10.1.0 255.255.255.0 10.255.255.2 1
route inside 10.10.17.0 255.255.255.0 10.10.201.2 1
route outside 10.251.4.0 255.255.255.0 10.255.255.2 1

nat (inside,outside) source static SideA-PC_real SideA-PC_nat destination static SideB-PC_nat SideB-PC_real

The debug logs show the translation happening exactly as I want, however a tcpdump from SideB shows it never gets forward there.

Pings only work if i add

route outside 10.10.17.155 255.255.255.255 10.255.255.2 1

to the ASA. Which I believe is because it is more specific than the 10.10.17.0 inside route.

Improve this question
4
  • I believe you might have mixed up the name of your objects. It makes it hard to understand what the issue is and what you are trying to achieve.
    – Alex
    Apr 29 '14 at 19:42
  • Sry, you are correct, config didn't copy over into the form correctly. Fixed.
    – Jim
    Apr 29 '14 at 19:58
  • The packet only gets forwarded correctly if I put a host /32 static route towards the outside(SideB) interface
    – Jim
    Apr 29 '14 at 19:58
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin ♦
    Aug 7 '17 at 20:14
3

I got it to work without putting the /32 routes in for each host, by issuing 

route outside 0.0.0.0 0.0.0.0 10.255.255.2

I tried to issue a 

route outside 10.10.17.0 255.255.255.0 10.255.255.2

However cisco complains the route already exists, even though it is for the outside interface.

I really don't like doing it this way, however I can't seem to find a way to have the Cisco ASA forward the packet based on the pre-nat destination.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.