I’ve been searching on this issue and can’t seem to find info about it.
I’ve inherited an older ASA5510 (8.2(1)) and unfortunately I’m pretty new to them. I have a set of overloaded NAT statements that will stop working seemingly at random.
access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq 3389 access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq www access-list 101 extended permit tcp x.x.x.88 255.255.255.248 host x.x.x.121 eq https access-list 101 extended permit tcp any host x.x.x.121 eq 222 static (inside,outside) tcp x.x.x.121 www 10.15.60.43 www netmask 255.255.255.255 static (inside,outside) tcp x.x.x.121 https 10.15.60.43 https netmask 255.255.255.255 static (inside,outside) tcp x.x.x.121 3389 10.15.60.2 3389 netmask 255.255.255.255 static (inside,outside) tcp x.x.x.121 222 10.15.60.42 ssh netmask 255.255.255.255
clear xlate it doesn’t come back. If I
show xlate for x.x.x.121 it shows them as still in there. However, if I remove the portions of the config listed above and add just
static (inside,outside) x.x.x.121 10.15.60.2 then
clear xlate then I’m able to connect to the server again.
If I then put the original config back in everything works fine for a day or two. Any thoughts or diagnostic commands that I should be running would be greatly appreciated.
Per Ricky Beam's suggestion I checked the number of users in
Maximum Physical Interfaces set to Unlimited.
Inside Hosts also set to Unlimited.
show local-host | inc host limit returns no results. I'm guessing since hosts are Unlimited.
I came in this morning and it was not allowing connections to that IP again. I did a
show conn count while it wasn't allowing connections and it shows 298 in use, 782 most used. I did a
clear xlate then a
clear conn all and it didn't start allowing connections. However, removing the
static (inside,outside) statements and adding
static (inside,outside) x.x.x.121 10.15.60.2 brought the connection up right away.
We did add a new building about 1 week before this started happening but has far as I can tell the asa is not actually running out of connections.
It does show Built dynamic UDP translation and Built outbound UDP connection in the log while it was not working though.
Was down again. Verified that the other devices that are overloaded on that IP are down as well. I can ping 10.15.60.2 using the
ping 10.15.60.2 command but I can't while sourced from the outside.
asa# ping Interface: outside Target IP address: 10.15.60.2 Extended commands [n]: Sweep range of sizes [n]: Type escape sequence to abort. Sending 5, 100-byte ICMP Echos to 10.15.60.2, timeout is 2 seconds: ?????
Ran the following show commands while it wasn't working.
asa# sh conn | include x.x.x.121 asa# sh xlate | include x.x.x.121 PAT Global x.x.x.121(80) Local 10.15.60.43(80) PAT Global x.x.x.121(443) Local 10.15.60.43(443) PAT Global x.x.x.121(3389) Local 10.15.60.2(3389) PAT Global x.x.x.121(222) Local 10.15.60.42(22)
The ASA is now logging to a syslog server at informational level. Hopefully that will show what is going on.