Hello all and thanks in advance for any help. Sorry to be so long-winded but it is a fairly complicated setup and wanted to give an overview of the entire config.Here is my situation I have a Cisco ASA5510 and we have 2 ISPs (PrimaryISP & BackupISP). We have recently changed our PrimaryISP but these problems developed LONG after that. The PrimaryISP is an ethernet handoff from a fiber circuit that goes into an open switch and then to the ASA. The backup circuit is an ethernet handoff that goes into a Cisco 1841 router and then into the same open switch which is then connected to a different port on the ASA. The PrimaryISP IP block is a /25. The BackupISP consisits of a /29 (public address on ASA) plus an additional /26 AND /25. The BackupISP circuit is used for Site-to-Site VPN connections from HQ to the datacenter and remote offices. It also serves incoming connections and as backup for our Anyconnect VPN clients and backup internet access at HQ. The ISP for the Backup had an outage about 2 weeks ago and since the outage I am unable to get incoming NAT rules to work. I can see the traffic passing through the 1841 to the ASA but once at the ASA I get a "no valid adjacency" as well as other erros. I have cleared xlate and arp, rebooted the ASA and the 1841, cleaned the config of all ACL's & NAT rule that would affect it and readded a single NAT that will not work for any of the BackupISP's ranges. Everything else (Anyconnect, site-to-site etc...) is working correctly.
Tek-Tips is the largest IT community on the Internet today!
Members share and learn making Tek-Tips Forums the best source of peer-reviewed technical information on the Internet!
-
Congratulations strongm on being selected by the Tek-Tips community for having the most helpful posts in the forums last week. Way to Go!
ASA5510 Strange NAT Problem
- Thread starter ssalyers
- Start date
- Thread starter
- #3
I agree but I have been through hours of trouble shooting with them and a tracroute shows it getting to our Cisco 1841 router. From within the router when I add a NAT entry, I can ping it and get replies so the traffic is getting to the ASA. When I look at the traffic in a syslog server I see it getting to the ASA from an external source. I'm thoroughly stumped!
- Status
Similar threads
- Locked
- Question