ASA 5510 UDP NAT problem

Update:

I just applied the nat-control command. This did not have any effect. The UDP packets are still being routed thru the ASA and are not NAT'd.

OK. I removed the NAT commands, reloaded the ASA, re-entered the same NAT commands. This seemed to relieve the problem. No more of the NTP packets showing up outbound on the ASA outside interface. The ACL that is denying all IP on the inside interface is incrementing. So it looks like it is working as expected now.

But this should not have had to be reloaded to resolve this. Is it possible that a clear local-host would have cleared this up?

Your thoughts on this appreciated.

Thanks,

Will

After making any translation changes it is best practice to issue the clear xlate command, this will clear the translations in the firewall already, what you did by reloading the firewall basically did this as well but you should not have to reload the firewall

Thanks for the input. I had seen this, but had not thought of trying it.

Any thoughts on why this was initially not meeting any of that nat rules and being routed without being translated?

nat (inside) 1 0.0.0.0 0.0.0.0

Instead of using 0.0.0.0 0.0.0.0 I would suggest limiting the statement to your internal subnet.

net (inside) 1 192.168.0.0 255.255.255.0

I need to allow access from multiple subnets. Would this require multiple NAT statements or can an access list be used to classify traffic. I haven't seen a good example of doing this in any of the materials that I have. Using the 0.0.0.0 mask was the suggestion in the command reference.

But I will be playing with it over the next couple of weeks.

You can use multiple nat (inside) 1 statements each naming a different subnet, or (with PIX 6.3) you can use nat with an access-list .

If you do use nat with an access-list, be sure to look up the priority order for the various forms of the 'nat' command.

Very cool. access-list in place and working well.