Monday, February 2, 2009

Crazy Static NAT Issue

Yesterday I replaced a Cisco Pix 515e (6.3) with an ASA 5510 (7.2). While I am not an expert on Cisco security, I have had to work with these devices quite a bit over the last few years, so I attempted to port as much of the existing configuration as possible to the new device and then attempted a cold cut over. I took down the old device and cabled up the new device and was presently surprised with the site-to-site VPN tunnels came back up and after a small tweak, client VPN worked again as well. To my dismay, there were static NAT statements that published a few inside network interfaces as outside public IP addresses. If time would have allowed, I would prefer to create a proper DMZ and migrate these services off of the LAN, but I digress... After testing everything else (Websense, Etc) it became clear that none of the NAT'd servers could get our and traffic could not come in. I probably spent an hour to 90 minutes looking at all of the ACLs and NAT statements. Finally, I thought about ARP cache. Perhaps, just maybe the Internet Router (AT&T provided 3800) was caching all of the other IPs used for static NAT as the old Pix's MAC Address and the ASA was not ARPing them? A reboot to the 3800 and all of a sudden, SMTP was coming in, the web site was up, all was good with the world again. Talk about a frustrating afternoon, always remember, if at first it doesn't work, reboot everything involved.. :P

No comments: