Ask questions about ASA NAT!!!
http://file///C:/DOCUME~1/ADMINI~1/LOCALS~1/Temp/enhtmlclip/Image(16).png http://siqilab.com:44305/data/attachment/forum/201307/19/112053s7lsxiiib2qlp76d.jpg
The topology is shown in the figure above
The establishment of IPSec VPN through asa505 is successful
1. You can dial in the VPN remotely and get the VPN pool address 192.168.3.10/24
2. The server IP behind the firewall gets 192.168.3.100/24 from DHCP
3. Now in order to let the server access the Internet, NAT: 192.168.3.0/24 is mapped to the WAN port in ASA, so that the server can access the Internet normally.
show nat interface inside detail
Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic Server interface
translate_ hits = 547, untranslate_ hits = 256
Source - Origin: 192.168.3.0/24, Translated: 125.*.*.*/32
The problem is: before NAT, VPN client 192.168.3.10 can ping server 192.168.3.100
&After finishing NAT, you can‘t Ping......
Firewall log shows:Asymmetric NAT rules matched for forward and reverse flows; Connection for icmp srcoutside:192.168.3.12 dstinside:192.168.3.101 denieddue to NAT reverse path failure
You need to let the intranet server access the Internet, and then you can ping each other after VPN dial in
Please master guidance, thank you!!!!!!!!!!!!!!!!!!!!!!
Pages:
[1]
