Problem with nat

[data78]

Hello

I have a concern with NAT rule in place, it works well but not coming out of the entrance.

When I do a ping (with a source option) eg I did not return, here are some excerpts from the debug:

562.243460 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 563.240380 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 564.240395 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 565.240566 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request 566.240335 wan1 out 192.168.70.253 -> 94.247.xx.xx: icmp: echo request

Wan1 matches my optical fiber, although it leaves the right place and accesses the remote server well.

Pushing my analysis I see this: id = 13 = 132 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 132 trace_id msg = "allocate a new session-0b251408" id = 13 = 133 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 133 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 134 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 134 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 135 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 135 trace_id msg = "Find an existing session-id 0b251408, original direction" id = 13 = 136 trace_id msg = "v-root received a packet (proto = 1, 192.168.70.253:14848->94.247.xx.xx:8) from local." id = 13 = 136 trace_id msg = "Find an existing session-id 0b251408, original direction"

The traceroute eventually happens to property: traceroute to 94.247.xx.xx (94.247.xx.xx), 32 hops max, 72 byte packets  5.172.xx.xx 1 <xx.xx.172.5.xx.net> 3.800 ms 2.774 ms 1.368 ms  5.172.xx.xx 2 <th2-isr02-g1-0-8.xx.net> 4.345 ms 6.096 ms 2.659 ms  3 5.172.xx.xx <xx.xx.172.5.xx.net> 1.082 ms 1.037 ms 1.019 ms  195.81.xx.xx 4 <xe-10-2-0-658.par-gar-score-1-re0.interoute.net> 3.247 ms 1.631 ms 1.713 ms  5 212.23.xx.xx <ae0-0.par-gar-score-2-re0.interoute.net> 1.756 ms 1.701 ms 1.764 ms  6 84.233.xx.xx <ae2-0.ams-koo-score-1-re0.interoute.net> 10.212 ms 10.190 ms 10.149 ms  7 80.249.xx.xx <amsix1.tc2.ams.as8218.eu> 22 672 ms 22 783 ms 23 145 ms  8 83.167.xx.xx <xe-0-0-0.ter1.ld.par.core.as8218.eu> 38 042 ms 22 545 ms 22 540 ms  9 83.167.xx.xx <xx.gw.ter1.ld.par.xx.com> 25 830 ms 22 636 ms 22 735 ms 10 94.247.xx.xx <xx.not.updated.xx.net> 22 954 ms 60 534 ms 22 749 ms 11 94.247.xx.xx <94.247.160.174.not.updated.openip-cs.net> 23 224 ms 23 043 ms 22 551 ms

Please show screenshot of my configuration : 

https://www.dropbox.com/s/vtvzicxc1pk8upf/Capture%20d%27%C3%A9cran%202016-01-14%2013.06.43.png?dl=0

I tried with and without Dynamic IP Pool

For in traffic : https://www.dropbox.com/s/cr6w9wcsuflkvy2/Capture%20d%27%C3%A9cran%202016-01-14%2013.07.56.png?dl=0

VIP redirect public IP to private IP

Thanks you for your reply,

Data78

[rwpatterson]

What is your goal here? In what direction are you trying to get traffic translated?

[data78]

Hi

Thanks you for reply.

I detail my architecture, I actually telephone service (Cisco UC320) that meets on a private IP 192.168.70.253.

So I need that: - Anything out of this IP is translated to the public IP 5.172.XX.XX - Everything that goes on IP 5.172.XX.XX be translated to the private IP 192.168.70.253

My goal is that my UC320 communicates with external SIP Trunk.

[rwpatterson]

OK, you are going to have two different scenarios:

1) Inbound traffic

2) Outbound traffic

For 1) you'll need a policy (outside to in) with the service(s) and a virtual IP (destination NAT) from the outside to 192.168.70.253.

For 2) you'll need a policy (inside to out) with the service(s) and NAT checked off. If you are using the firewall's interface IP, then you're done. If you are using a different IP in your public range, then you will have to create an IP pool with a single address, and use that in the policy. (source NAT).

[data78]

Okay thanks my configuration looks good : 

For outbound https://www.dropbox.com/s/vtvzicxc1pk8upf/Capture%20d%27%C3%A9cran%202016-01-14%2013.06.43.png?dl=0 For inbound https://www.dropbox.com/s/cr6w9wcsuflkvy2/Capture%20d%27%C3%A9cran%202016-01-14%2013.07.56.png?dl=0

But this does not look good, I'm doing something wrong?

[rwpatterson]

For outbound, use the correct interfaces, not 'any'. For the inbound, could we get a look at the Virtual IP configuration?

[data78]

I have this : https://www.dropbox.com/s...14%2019.09.00.png?dl=0