NAT does not work

Hello

NAT seems not to work on my pix.

I checked my config n-times. No question :(

Please is - can someone check my config and tell what is the problem? and thanks in advance.

I have a modem DSL (Siemens) working as a default router (x.x.16.17)

Here is the config (x and are the same everywhere in the script)

6.2 (2) version PIX

ethernet0 nameif outside security0

nameif ethernet1 inside the security100

activate 7PmXr29jODRJ.eaI encrypted password

7PmXr29jODRJ.eaI encrypted passwd

tita hostname

domain any.net

fixup protocol ftp 21

fixup protocol http 80

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol they 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol smtp 25

fixup protocol sqlnet 1521

fixup protocol sip 5060

fixup protocol 2000 skinny

names of

access-list inside_access_in allow icmp a whole

inside_access_in ip access list allow a whole

access-list outside_access_in allow icmp a whole

interface ethernet0 10baset

Auto interface ethernet1

ICMP allow all outside

ICMP allow any inside

Outside 1500 MTU

Within 1500 MTU

IP address outside x.y.16.18 255.255.255.248

IP address inside 192.168.22.2 255.255.255.0

alarm action IP verification of information

alarm action attack IP audit

location of PDM 192.168.22.5 255.255.255.255 inside

history of PDM activate

ARP timeout 14400

Global (outside) 10 x.y.16.19 - x.y.16.21 netmask 255.255.255.248

NAT (inside) 10 0.0.0.0 0.0.0.0 0 0

Access-group outside_access_in in interface outside

inside_access_in access to the interface inside group

Route outside 0.0.0.0 0.0.0.0 x.y.16.17 1

Timeout xlate 03:00

Timeout conn 01:00 half-closed 0: 10:00 udp 0:02:00 CPP 0: h323 from 10:00 0:05:00 sip 0:30:00 sip_media 0:02:00

Timeout, uauth 0:05:00 absolute

GANYMEDE + Protocol Ganymede + AAA-server

RADIUS Protocol RADIUS AAA server

AAA-server local LOCAL Protocol

Enable http server

http 192.168.22.5 255.255.255.255 inside

No snmp server location

No snmp Server contact

SNMP-Server Community public

No trap to activate snmp Server

enable floodguard

No sysopt route dnat

Telnet 192.168.22.5 255.255.255.255 inside

Telnet timeout 5

SSH timeout 5

username password of samir. Encrypted KnHwytEP2k92JAD privilege 15

Terminal width 80

Cryptochecksum:abd0f7a4e9339ff5026a3c5c9234cfa1

Try just of Polo to the outside, using the interface:

"global (outside) 10 interface.

and get rid of your other global declarations (might have to remove the "nat (inside) 10 0.0.0.0 0.0.0.0 0 0 ' first or the pix could complain, I forgot).

"I have a modem DSL (Siemens) working as a router by default (x.x.16.17)

"Here is the config (x and are the same everywhere in the script)"

Hereby you mean that the ADSL Modem is also a router? or is your ISP's router x.x.16.17 and they gets you a block of IP addresses? If this is the case, then the ISP router must know to get your addresses using NAT to the PIX.

The trace of icmp shows that the PIX is originating and pings are extinguished as one of your NAT pool addresses, but he won't return. So I really think that your router upstream does not know to send packets to your NAT addresses to your PIX address. If PAT interface work, then that will be displayed exactly that, because the PIX knows to y to answer because it is addressed to him. But the NAT addresses are not directly on the PIX, they exist on this subject and the PIX knows what to do once she gets them, but they must be routed to it.

-John

Tags: Cisco Security

Similar Questions

  • NAT does not work unless I have also use DHCP

    I'm sure this is probably somewhere but I can't find the answer.

    (My home system - try things)

    I have a guest linux (vyatta) set up as a 'virtual' router, connected to the host linux via NAT.   Other guests windows allows access to the 'real' router provided by my ISP and the internet beyond this router.

    I used the automatic DHCP server on the virtual network of NAT between host and virtual router and it was working well, but I decided to try the static IP instead. I thought I just needed to configure static IP addresses and disable the DHCP server.

    It works not well - has more no connection between the virtual NETWORK adapter on the host computer and the 'real' router facing NIC I can't ping the 'real' virtual router router or a windows guest.

    Why is this?

    Thank you

    Welcome to the community,

    Looks like a complicated configuration

    Are what OS you running on host computers? At least with the hosts Windows the NAT virtual gateway address is x.x.x.2. You have configured the gateway address into your virtual router?

    André

  • Identity firewall does not work with NAT

    We implement an environment that restrict access to Internet with rules based on users and groups to Active Directory.

    There were many difficulties, but the current state is:

    -The 'Test' of the firewall server-> identity Options results GOOD group

    -The 'Test' of Agent of Active Directory on Windows-> identity Options GOOD results

    -The rules we applied on the inside Firewall identity-based Interface are no "respected".

    The environment:

    -We have two ASA 5520 to failover.

    -There are four contexts in this pair of ASA.

    -Now we are activating the firewall of identity in a context.

    -Of course, the AD are in one of the inside of this context, networks.

    On the Configuration Guide of the identity of Firewall, to

    http://www.Cisco.com/en/us/docs/security/ASA/asa84/asdm64/configuration_guide/access_idfw.html#wp1349541

    We have seen that there are a lot of features that are not supported:

    ...

    The following features of ASA do not support the use of the object based on the identity and the FULL domain name:

    Route-map

    -Crypto card

    -WCCP

    -NAT

    -Group (except filter VPN) policy

    -DAP

    ...

    When using NAT does not, just remove NAT.

    How to configure this feature? Identity with NAT work?

    This is the reason why you have not any user ip in ASA mappings.

    Domain configured in ASA name must be the netbios domain name and it must be matched with one that you see 'adacfg dc list' output, otherwise ASA will drop all user agent AD ip report.

    You can have a try with the following new configs.

    field of the identity of the user TEST4 aaa-Server AD-TEST4

    identity of the user by default-field TEST4

    inside_access_in list extended access deny the user ip TEST4\rodrigo a whole

  • OSX Server caching does not work after update

    It was low on my priority list, but the OSX Server that we run in the House for the caching seems to have stopped caching; from what I remember, it was related to the update software to 10.11.4 of what it was before, and server software everything that has been installed to 5.1. Updates both to the latest versions now have not helped. It of kind of frustrating, but all he puts in cache are now asking that makes for itself. No customer request is visible. It worked before.

    There seems to be no useful diagnostic that I can find to establish why the hell it suddenly does not work.

    Platform: Mac Mini, "the end of 2014", bought this year. OSX currently on 10.11.5; 5.1.5 Server

    Network configuration: IP public addresses multiple; several subnets.

    Clients do not use the same IP address as a server.

    Full assignment of the IP of the site listed in _aaplcache._tcp TXT DNS records (plural - because I did it for the DNS records for each subdomain DNS LAN client) using the type prs; DNS is on Windows Server 2012R2. Any length of characters, because they were not specified during the installation of OSX Server cached the required DNS records.

    No firewall is between the server and clients on the local network (only a L3 switch), but obviously, if the customer traffic leaves our network, it passes through a firewall. No change to the rule group since it worked finally.

    The Mac Mini has an interface (with IP address and corresponding DNS record) in each subnet of the client (using virtual LANs), but it seems to register with the Apple servers using its main wired LAN IP (which can reach customers) with the Apple servers.

    Mac Mini connects via gigabit ethernet.

    Wireless connectivity is through a mix of HP MSM and Ubiquiti access points; no system seems to result in customer traffic.

    My understanding of the protocols involved are something along these lines.

    -OSX server registers with Apple, using its normal connection; transmits the local LAN IP address for the cache clients to use; can pass TXT DNS records to help "seed" of customers, or can use the parameter entry in the cache server configuration.

    -Customers use the TXT DNS record to inform the global servers of Apple that they need the IP address of the server cache.

    -Apple returns the local LAN IP address.

    -The customer is for the server cache.

    -Profit.

    I certainly see the first happening party - the Debug.log show apparently successful registration; the cache in the applet Server service is green - but no client request seems to happen.

    Obscured address IP addresses are correct.

    Things are green and just seem to.

    Looks like he should be happy.

    IPs are correct and correspond to the DNS records.

    Help! What other steps can I take to diagnose - and trouble - this problem? The Apple Help documentation is not really very useful (I understand what he says), but he doesn't really give sysadmin level overview of what to do when he's not "just works".

    Thanks in advance for all understand how to debug properly and fix this.

    .. .clients can and collect software on the internet (that we want to avoid as much as possible).

    Amount of updated data in cache is so small that I did it (reset button) in the case which has been randomly a question. No joy. Was previously more than 300 GB in size, across many types of content.

    If it is not clear, the clients and servers using NAT, but different IP are used, depending on the subnet they come. He previously worked.

  • Port forwarding does not work on EA6900

    Please help me to know what is the reason for this port forwarding does not work on my Linksys router:

    Model: EA6900 v1.1
    Firmware version: 1.1.42.161129

    I've set up two ports: TCP 22 and 8070 TCP to 192.168.1.10. (192.168.1.10 is up and running, I can reach the LAN ports).

    Yesterday, I had a live chat with Linksys support we tried to re - download the firmware even, but that did not help. Then factory reset and reconfigure the router did not help either.

    Unchecking "Filter anonymous Internet requests" and disable uPNP didn't help either (they have been suggested in similar topics).

    However, the IP displayed tab troubleshooting/Diagnostics reflect my external IP address (the IP displayed by http://whatismyip.com), which is weird, because I never have IP from my ISP from 100, that is displayed on the Diagnostics tab. So I guess it's a fake display or it relates to access to my router via www.linksyssamrtwifi.com ?

    Anyway I tried the two IPs from the outside, but the transfer simply doesn't work. (It works fine when I use my old router TP-Link).

    Please advise!

    Sorry guys, it seems indeed a double NAT problem. My ISP can detected MAC address change when I started using EA6900 (thinking that I couldn't not need public IP?) and since then he sends me IPs for NAT - ed. It is strange that the same day, he was working with my old router, but now it is even not working with my old router and not even working when I connect directly to my windows PC to my ISP (via PPPoE). I called their support line and they said that they will solve this problem within 72 hours. In any case, thanks for your help!

  • RV110W QuickVPN does not work

    Hi all

    I have a problem with my RV110W router. I would like to configure access QuickVPN. The manual is pretty simple: enable management to users to create, install the client and that of it, should work. But isn't. It does not work.

    Few questions. Remote management is enabled on port 8080. Should it be changed by 443 as required for QVPN? Or it doesn't matter. It's ok, to have management on 8080 and QVPN 443?

    I tried to connect via the customer QVPN worm. 1.4.1.2.

    Each time the same error msg, see entry wget_error.txt:

    https://USER1: [email protected] / * /: [email protected] / * / RES = user1: Bad port number.

    Of course the ip as user and pass was changed.

    I tried to change the port management to 443, but first:

    1. I wasn't able to access the GPMC to all the

    2 QVPN - still does not work

    Any help really appreciated.

    If you want more details, let me know.

    THX,

    Miro

    Miroslaw salvation,

    First of all, for Quick VPN to connect to the router to that remote management is enabled on port 443.

    If you are able to connect to the web interface of the router of th on port 8080 and not when you change the Rremote management to port 443, it means that another device using port 443.

    Where RV110 is behind a NAT - to the front, there's another router with a public IP address, it could mean that this port is used by this device, or it is not transmitted to the RV110 at all. If it comes to your configuration, you must forward other ports (UDP 500 and 4500)

    If RV110 is configured with the public IP address on the WAN port, check that you have not created rules for this port of port forwarding.

    In all cases you need to free this port firs order to use fast VPN

  • Client VPN suddenly does not work

    An external interface address changed on this PIX 501 yesterday - all of a sudden their client VPN does not work.  I checked that nothing in the config VPN configuration has changed.  I now see a *(HASH.) ("OAK NOTIFY ISAKMP INFO: NO_PROPOSAL_CHOSEN") in the journal on the VPN client.

    I crossed referenced on google - nothing in the statements of NAT, Access-list, or VPN configurations have changed.  Any ideas?

    Thank you
    Greg

    Your configuration is absolutely perfect.

    Please, try the following:

    no interface card VPN crypto outdoors

    card crypto VPN outside interface

    Remove and reapply the cryptomap on the external interface and see if that helps.

    Thank you

    Jeet Kumar

  • Windows 95 Ethernet adapter does not work

    Hello

    I have created a machine virtual windows 95 and followed the instructions exactly in the link below.

    Documentation for VMware for Windows 95

    However, the network adapter does not work.  I have the latest version of VMware tools installed, but it does not seem to include any network card driver.

    I tried to download the driver for AMD PCNET Family Ethernet Adapter (PCI and ISA) from the AMD website, but that doesn't work anymore.  I have a virtual machine running Windows 95.  However, he created an image of a physical machine.  The ethernet adapter works fine on this machine, but there is no driver installed - does not require a apparently.

    If anyone has an idea on how to make the ethernet card works, I would be eternally grateful!

    Here is the configuration I have for the Windows 95 VM I created:

    . Encoding = "windows-1252".

    config.version = '8 '.

    virtualHW.version = "6".

    scsi0. Present = 'TRUE '.

    memsize = "64".

    ide0:0. Present = 'TRUE '.

    ide0:0. FileName = "7Win95.vmdk".

    ide0:0. DeviceType = 'disk '.

    IDE1:0. Present = 'TRUE '.

    IDE1:0. AutoDetect = "FALSE".

    IDE1:0. DeviceType = "cdrom-raw"

    floppy0.startConnected = "FALSE".

    floppy0. FileName = "a":

    floppy0. AutoDetect = 'TRUE '.

    ethernet0. Present = 'TRUE '.

    ethernet0. ConnectionType = "nat".

    ethernet0.virtualDev = "vmxnet.

    ethernet0.wakeOnPcktRcv = "FALSE".

    ethernet0. AddressType = 'generated '.

    Sound.Present = 'TRUE '.

    sound.fileName = "-1".

    Sound.AutoDetect = "TRUE".

    roamingVM.exitBehavior = 'go '.

    displayName = "7Win95."

    guestOS = "win95".

    virtualHW.productCompatibility = "hosted".

    extendedConfigFile = "7Win95.vmxf".

    IDE1:0. FileName = 'D: '.

    floppy0.FileType = "peripheral".

    floppy0.clientDevice = "FALSE".

    IDE1:0.startConnected = 'TRUE '.

    ethernet0.generatedAddress = "00: 0C: 29:66: ff: 4 d.

    tools.syncTime = "FALSE".

    UUID. Location = "56 4 d f3 c8 9 c 66 1 0 b - df 02 c3 6 3rd b 66 c ff 4 d.

    UUID. BIOS = "56 4 d f3 c8 9 c 66 1 0 b - df 02 c3 6 3rd b 66 c ff 4 d.

    cleanShutdown = 'TRUE '.

    Replay.Supported = "FALSE".

    ide0:0. Redo = «»

    Replay.FileName = «»

    vmotion.checkpointFBSize = "21102592".

    ethernet0.generatedAddressOffset = '0 '.

    USB. Present = "FALSE".

    pciBridge0.present = 'TRUE '.

    pciBridge0.pciSlotNumber = "17".

    scsi0.pciSlotNumber = "16".

    ethernet0.pciSlotNumber = "32".

    sound.pciSlotNumber = "33".

    Try changing line ethernet0.virtualDev = "vmxnet' to 'vlance.

    Once the AMD driver is installed and running, THEN you can try to change the vmxnet driver, by repairing the VMware Tools on the guest.

  • Dremweaver CS6. Design mode does not work.

    dreamweaver.jpg

    Hello.

    Design mode does not work.

    I got this instead of the normal display mode.

    What's wrong with it?

    Kind regards

    NATA

    Go to the main toolbar and choose View > happy head and turn it off.

  • Internet does not work on VM

    VM version: 6.5.1

    Host OS: Windows XP Professional Version 2002 SP2 (not sure how to check if it's 32-bit or 64-bit)

    Guest OS: Windows XP Professional x 64 SP2 Version

    VMware Tools installed: it is installed, but for some reason, he said VMware Tools is not running in the status bar.

    I just installed VMware Tools a few days ago, and I've spent hours trying to solve this problem of the internet works is not on the virtual Windows machine. It seems that the Virtual Machine is not connected to my router, because cannot find my address of 10.1.1.1 on Windows from VMware routers. The internet did not work because I installed VMware, and I was not able to find a solution.

    ipconfig/all results for host OS:

    Windows IP configuration:

    Host name: winxp

    Primary DNS suffix:

    Node type: unknown

    Active IP routing: no

    WINS proxy enabled: no

    Ethernet VMware Network adapter adapt VMnet8:

    The connection-specific DNS suffix:

    Description: VMware Virtual Ethernet adapt for VMnet8

    Physical address: 00-50-56-C0-00-08

    DHCP enabled: no

    IP address: 192.168.195.1

    Subnet mask: 255.255.255.0

    Default gateway: 10.1.1.1

    Ethernet VMware Network adapter adapt VMnet1:

    The connection-specific DNS suffix:

    Description: VMware Virtual Ethernet adapt for VMnet1

    Physical address: 00-50-56-C0-00-01

    DHCP enabled: no

    IP address: 192.168.128.1

    Subnet mask: 255.255.255.0

    Default gateway:

    Ethernet connection to the Local network card:

    The connection-specific DNS suffix:

    Description: VIA compatible Fast Ethernet Adapter

    Physical address: 00-15-F2-6E-BF-62

    DHCP enabled: no

    IP address: 10.1.1.126

    Subnet mask: 255.0.0.0

    Default gateway: 10.1.1.1

    DNS servers: 202.27.158.40

    202.27.156.72

    ipconfig/all results for the guest operating system:

    Windows IP configuration

    Host name: aasev-af048787b

    Primary DNS suffix:

    Node type: unknown

    Active IP routing: no

    WINS proxy enabled: no

    Ethernet connection to the Local network card:

    The connection-specific DNS suffix:

    Description: Intel & lt; R & gt; PRO/1000 MT network connection

    Physical address: 00-0C-29-24-92-A8

    DHCP enabled: no

    IP address: 192.168.195.2

    Subnet mask: 255.255.255.0

    Default gateway: 10.1.1.1

    How the host is connected to the network : a router

    The network configuration for comments : NAT

    Firewall settings: I tried with no firewall on the host and the guest and she still does not work.

    Any help would be appreciated, because I have no idea about computers.

    sexymonkeys wrote:

    Applications has expired with 100% loss, so I guess that the problem was the lack of connectivity to the default gateway

    OK, so your feedback is apparently able to receive/send DHCP, yet http traffic packages and the ping does not work.

    -You use the firewall part 3 on your host?  If so, try disabling it temporarily to see if makes a difference.

    -Can you check to see if there is a updated for your host network adapter driver?

  • Safari does not work after installing macOS Sierra

    Safari and apple store does not work after installing macOS Sierra

    Alas, my crystal ball is in the shop for cleaning, so you will need to provide more details on what "doesn't work" and above all error messages. First of all, let's start the App Store. Provide as much information as possible for those of us who do not sit on your shoulder.

  • My iPad Apple 3rd generation wifi + his cell phone does not work

    MY 3rd generation Apple iPad, wifi + cell

    model number MD408LL/a

    Serial number DM * VGL

    THE SOUND DOES NOT WORK

    < personal information under the direction of the host >

    All sounds, or simply notification and sounds apps (for example do music and videos app still have sound)? If notifications and apps you have notifications on mute: on the iPad side switch - Apple Support ? If the sounds in all applications which have tried for example soft-reset/reboot of the iPad, insert/remove the headphones?

  • After recent, iPhone, 6, update, Windows, Explorer, does not work, see, iPhone

    I installed the latest update required for my iphone ios 6 a few days ago, and now when I try to download pictures from my iphone to my PC (via USB connection), the PC does not see the iphone.   iTunes sees it yet, but windows Explorer does not work.  It seems that some setting has been broken through the update of ios.  A way to solve this problem?

    Restart the computer and the iPhone. Unlock the iPhone before connecting it to the computer. Any change?

    TT2

  • Open the link behind Mail does not work

    Sierra using my link opened behind Mail does not work. The link opens on the top of the window.

    This option works for me in Sierra... is working for you with your previous version of the OS?

  • iPhone 5 home button does not work after ios 10

    My 5 Iphone Home button does not work after update final IOS version of 10.

    The home button works on the first push to wake the phone but it will not open the phone the second button.

    I activated the assist button, which does not work either. But what I discover is if I open device for assistance then touch and lock screen click on the button home will work once to open the phone. If I open any app I can't close it unless I go through the same routine.

    You attempted to restart your phone?

    You can do so by holding the sleep/wake button and the Home button simultaneously until the Apple logo appears

Maybe you are looking for

  • HP software detects the printer, but then "the printer could not be installed on the network.

    I tried looking for a similar problem, but have had no success yet.  I doubt I'm the first to this problem! The computer is XP SP3, is printer Deskjet 3050 has, and it's a WiFi WPA - PSK. The printer confirms that it is connected to WiFi. When I run

  • Desktop shortcuts

    I have a compaq presario CQ 5720F Windows 7, I can't open my desktop shortcuts (only a little). E-mail & games will not... A notice appears saying that it is a problem of the internet and the problem of "http" but do not understand this. Yesterday, I

  • HP Solution Centre into conflict with Adobe Flash Player

    I have a HP Deskjet F2210 printer and when I installed the latest update of Adobe Flash Player hp Solution Center does not open. I uninstalled the flash player and the hp Solution Center. I then reinstalled the solution Center and it works fine. I in

  • Suddenly can't play Champions online after the computer in the shop

    Friday, I had my computer after a week in the shop for a major overhaul.  (still do not know what version of Windows XP I have now - hard to find the specs.)  Was one of the first things I reinstalled my software for Champions online, a MMPORG I play

  • Scanning multiple Documents

    I have a desktop HP 2050 J510 jet. 75 percent of what I use the for analysis. It creates a file for each page that I scan and then I have to go back and remove a ton of files that I don't need. Is there a way to disable the feature folder?