top of page
Search

Cisco ASA NAT Exemption Miss: packet-tracer When Site-to-Site Traffic Gets Hide-NAT

  • 4 days ago
  • 2 min read
Cisco ASA network security troubleshooting lab
Cisco ASA · Techclick CLI troubleshooting lab
LAN-to-LAN VPN is up. Interesting traffic is hide-NATed to the outside IP and the peer drops it.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on Cisco ASA for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

packet-tracer will show NAT hitting the wrong rule. Add or reorder nat (inside,outside) source static obj-local obj-local destination static obj-remote obj-remote.

Why this ticket shows up

ASA NAT is top-down. A general hide-NAT above the exemption steals VPN traffic.

Symptoms operators actually see

  • Tunnel up, no interesting traffic

  • packet-tracer shows unneeded NAT

  • Works when sourced from the ASA itself

  • Recent object-NAT added

CLI first — copy this block

Run these on the Cisco ASA device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

packet-tracer input inside tcp 10.1.1.10 1025 10.2.2.10 445
show nat detail
show vpn-sessiondb l2l
show crypto ipsec sa peer 198.51.100.2

How to read that output

packet-tracer NAT phase must show the exemption (identity NAT). If it shows dynamic hide, that is the bug.

Triage order

  1. Run packet-tracer with real hosts

  2. Find the hide rule that hit

  3. Insert identity NAT above it

  4. Clear xlate for those hosts

  5. Send LAN traffic again

Classic traps

What you see

Real cause

Fix

Change the crypto ACL

NAT stole the packet

Fix NAT order

Disable all NAT

Internet will break

Add exemption only

Ping from the ASA

ASA is not in the ACL

Ping from a LAN host

Proof the ticket is closed

  • packet-tracer NAT is identity

  • IPsec SA encaps increment

  • File share works

Say this in an interview

On ASA I always packet-tracer VPN traffic through the NAT phase before I touch crypto.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments

bottom of page