Skip to main content
data78
data78
New Member
January 14, 2016
Question

Problem with nat

  • January 14, 2016
  • 1 reply
  • 5202 views

Hello

I have a concern with NAT rule in place, it works well but not coming out of the entrance.

When I do a ping (with a source option) eg I did not return, here are some excerpts from the debug:

562.243460 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 563.240380 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 564.240395 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 565.240566 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 566.240335 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request

 

Wan1 matches my optical fiber, although it leaves the right place and accesses the remote server well.

 

Pushing my analysis I see this: id = 13 = 132 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 132 trace_id msg = "allocate a new session-0b251408" id = 13 = 133 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 133 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 134 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 134 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 135 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 135 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 136 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 136 trace_id msg = "Find an existing session-id 0b251408, original direction"

 

The traceroute eventually happens to property: traceroute to 94.247.xx.xx (94.247.xx.xx), 32 hops max, 72 byte packets  5.172.xx.xx 1 <xx.xx.172.5.xx.net> 3.800 ms 2.774 ms 1.368 ms  5.172.xx.xx 2 <th2-isr02-g1-0-8.xx.net> 4.345 ms 6.096 ms 2.659 ms  3 5.172.xx.xx <xx.xx.172.5.xx.net> 1.082 ms 1.037 ms 1.019 ms  195.81.xx.xx 4 <xe-10-2-0-658.par-gar-score-1-re0.interoute.net> 3.247 ms 1.631 ms 1.713 ms  5 212.23.xx.xx <ae0-0.par-gar-score-2-re0.interoute.net> 1.756 ms 1.701 ms 1.764 ms  6 84.233.xx.xx <ae2-0.ams-koo-score-1-re0.interoute.net> 10.212 ms 10.190 ms 10.149 ms  7 80.249.xx.xx <amsix1.tc2.ams.as8218.eu> 22 672 ms 22 783 ms 23 145 ms  8 83.167.xx.xx <xe-0-0-0.ter1.ld.par.core.as8218.eu> 38 042 ms 22 545 ms 22 540 ms  9 83.167.xx.xx <xx.gw.ter1.ld.par.xx.com> 25 830 ms 22 636 ms 22 735 ms 10 94.247.xx.xx <xx.not.updated.xx.net> 22 954 ms 60 534 ms 22 749 ms 11 94.247.xx.xx <94.247.160.174.not.updated.openip-cs.net> 23 224 ms 23 043 ms 22 551 ms

 

Please show screenshot of my configuration : 

https://www.dropbox.com/s/vtvzicxc1pk8upf/Capture%20d%27%C3%A9cran%202016-01-14%2013.06.43.png?dl=0

I tried with and without Dynamic IP Pool

For in traffic : https://www.dropbox.com/s/cr6w9wcsuflkvy2/Capture%20d%27%C3%A9cran%202016-01-14%2013.07.56.png?dl=0

VIP redirect public IP to private IP

 

Thanks you for your reply,

Data78

    1 reply

    rwpatterson
    rwpatterson
    New Member
    January 14, 2016

    What is your goal here? In what direction are you trying to get traffic translated?

    data78
    data78Author
    New Member
    January 14, 2016

    Hi

    Thanks you for reply.

    I detail my architecture, I actually telephone service (Cisco UC320) that meets on a private IP 192.168.70.253.

    So I need that: - Anything out of this IP is translated to the public IP 5.172.XX.XX - Everything that goes on IP 5.172.XX.XX be translated to the private IP 192.168.70.253

    My goal is that my UC320 communicates with external SIP Trunk.

    rwpatterson
    rwpatterson
    New Member
    January 14, 2016

    OK, you are going to have two different scenarios:

    1) Inbound traffic

    2) Outbound traffic

     

    For 1) you'll need a policy (outside to in) with the service(s) and a virtual IP (destination NAT) from the outside to 192.168.70.253.

     

    For 2) you'll need a policy (inside to out) with the service(s) and NAT checked off. If you are using the firewall's interface IP, then you're done. If you are using a different IP in your public range, then you will have to create an IP pool with a single address, and use that in the policy. (source NAT).

    Terms & ConditionsAccessibility statement