I have a Twice NAT routing question. How do I forward an IP packet based on the pre-translated destination? Right now I have conflicting subnets between two sites which is why I am doing the Twice NAT. However, I believe the Cisco ASA is routing based on the post-translated address and therefore not forwarding the packet in the correct direction.

Here's my code

interface GigabitEthernet0
 nameif inside
 security-level 100
 ip address
interface GigabitEthernet3
 nameif outside
 security-level 0
 ip address

object network SideA-PC_real
object network SideA-PC_map
object network SideB-PC_real
object network SideB-PC_map

route outside 1
route inside 1
route outside 1

nat (inside,outside) source static SideA-PC_real SideA-PC_nat destination static SideB-PC_nat SideB-PC_real

The debug logs show the translation happening exactly as I want, however a tcpdump from SideB shows it never gets forward there.

Pings only work if i add

route outside 1

to the ASA. Which I believe is because it is more specific than the inside route.

  • I believe you might have mixed up the name of your objects. It makes it hard to understand what the issue is and what you are trying to achieve.
    – Alex
    Apr 29, 2014 at 19:42
  • Sry, you are correct, config didn't copy over into the form correctly. Fixed.
    – Jim
    Apr 29, 2014 at 19:58
  • The packet only gets forwarded correctly if I put a host /32 static route towards the outside(SideB) interface
    – Jim
    Apr 29, 2014 at 19:58
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 7, 2017 at 20:14

1 Answer 1


I got it to work without putting the /32 routes in for each host, by issuing

route outside

I tried to issue a

route outside

However cisco complains the route already exists, even though it is for the outside interface.

I really don't like doing it this way, however I can't seem to find a way to have the Cisco ASA forward the packet based on the pre-nat destination.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.