ASA Asymmetric NAT

We had a normal AnyConnect VPN configured and everyone could get to the inside resources. We then put an application in the DMZ and some vendors needed access to it. When we tried to hit one of the servers we got the following error.

%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection for tcp src outside:10.200.80.143/55759 dst DMZ:10.8.1.101/3389 denied due to NAT reverse path failure

Looking up the logging error on Cisco provided a little bit of info and scouring the net did too, but no clear definitive “fix”. Thinking about what it was doing and reviewing the NAT rules I was pretty sure I  knew what was happening. Traffic was getting NAT’d out of the DMZ. We certainly didn’t want that. I create a NAT0 entry (I’m running 8.2.5 on this particular firewall) and that fixed it.

VPN assigned addresses: 10.200.80.0 /24
DMZ address space: 10.8.1.0 /24

Commands to resolve:

ASA-VPN-FW(config)# access-list DMZ_ACCESS_FROM_VPN permit ip 10.8.1.0 255.255.255.0 10.200.80.0 255.255.255.255
ASA-VPN-FW(config)#  nat (DMZ) 0 access-list DMZ_ACCESS_FROM_VPN

5 Comments on “ASA Asymmetric NAT”

  1. Wholesale Cheap Jerseys From China Factory Online. 100% Stitched Authentic NFL Jerseys From Cheap Jerseys China Store and NBA MLB NHL NCAA Jerseys Wholesale with Free Shipping Now.cheap NFL Authentic Jerseys From China Outlet $16.Wholesale NFL Jerseys from our Official Cheap NFL Jerseys CHINA Company, we wholesale NFL Jerseys with the lowest factory price.
    [url=http://cheapnfljerseysonlinesale.podeestore.co.uk]cheap nfl jerseys[/url]
    cheap nfl jerseys

  2. Fake Oakley sunglasses | cheap Ray bans outlet | Sunglasses Outlet,Welcome to oakley outlet online shop to select high quality replica oakleys sunglasses,all kinds of style for men and woman,enjoy free shipping and fast shipping,100% quality guarantee!Oakley UK Outlet Online Store,Cheap Oakley Sunglasses UK Sale.
    oakley outlet uk

  3. Wholesale NFL Steelers Jerseys Cheap Free Shipping,Cheap NFL Jerseys Supply, Wholesale Authentic NFL Jerseys – Buy Cheap Authentic NFL Jerseys from Reliable China Cheap Authentic Sports Jerseys suppliers,Wholesale Cheap NFL Jerseys Online Discount Store.$18 Cheap Jerseys.Shop For Cheap Nike NFL Jerseys From Wholesale Jerseys China Online.wholesale cheap authentic nfl jerseys free shipping Low price.
    kids nfl jerseys cheap

  4. Ray Ban Uk Sale Outlet – Ray Ban Wayfarer Sunglasses Sale Online,Cheap replica ray bans sunglasses outlet uk,offer kinds of fake ray bans,buy more big discount,buy fake ray ban sunglasses here,high quality enjoy and fast free shipping.Welcome to our cheap oakley sunglasses uk store,Oakley sunglasses lead the fashion in every season, they made in top quality material with fashion design. There are many different styles cheap oakley sunglasses uk for you to choose.
    cheap oakley sunglasses uk

  5. Ray Ban Uk Sale Outlet – Ray Ban Wayfarer Sunglasses Sale Online,Cheap replica ray bans sunglasses outlet uk,offer kinds of fake ray bans,buy more big discount,buy fake ray ban sunglasses here,high quality enjoy and fast free shipping.Welcome to our cheap oakley sunglasses uk store,Oakley sunglasses lead the fashion in every season, they made in top quality material with fashion design. There are many different styles cheap oakley sunglasses uk for you to choose.
    ray ban uk outlet

Leave a Reply