Some packets don't get NATted correctly

[roadrunner]

Some packets don't get NATted correctly
Symptoms: Some untranslated packets from the dmz are dropped by the anti-spoofing on the internet router. Some tcp sessions get lost in space after some random time.
Some packets from some sessions are not translated although the logs entries contains the expected address translation values.


fw1 log:


source:client_IP Dst:www_IP xlated source:client_IP xlated dst:dmz_IP
source:access_router dst:dmz_IP proto:icmp code:3/13
cisco syslog: [access_router] %SEC-6-IPACCESSLOGP: list 120 denied tcp dmz_IP(80) -> client_IP(1830), 1 packet
snoop/tcpdump/sniffer on internet interface:

source:client_IP dst:www_ip SYN
source:www_IP dst:client_ip SYN+ACK
source:client_IP dst:www_ip ACK
source:client_IP dst:www_ip GET /
*source:dmz_IP dst:client_ip ACK (without tcp payload) - this packets comes 0.2 second after the GET /
source:access_router dst:dmz_ip icmp 3/13
*source:dmz_IP dst:client_ip ACK (without tcp payload)
source:access_router dst:dmz_ip icmp 3/13
*source:dmz_IP dst:client_ip ACK (without tcp payload)
source:access_router dst:dmz_ip icmp 3/13
*source:dmz_IP dst:client_ip RST
snoop/tcpdump/sniffer on dmz interface:

source:client_IP dst:dmz_ip SYN
source:dmz_IP dst:client_ip SYN+ACK
source:client_IP dst:dmz_ip ACK
source:client_IP dst:dmz_ip GET /
source:dmz_IP dst:client_ip ACK (without tcp payload) - this packets comes 0.2 second after the GET /
source:access_router dst:dmz_ip icmp 3/13
source:dmz_IP dst:client_ip ACK (without tcp payload)
source:access_router dst:dmz_ip icmp 3/13
source:dmz_IP dst:client_ip ACK (without tcp payload)
source:access_router dst:dmz_ip icmp 3/13
source:dmz_IP dst:client_ip RST
It seems the problem does not affect sessions without the 0.2 second delay (the usual delay is 0.01 second).

Answer


--------------------------------------------------------------------------------
Changing all the 'install on' fields from 'gateways' or 'all' to 'target','your firewall' seems to solve the nat issue.
--------------------------------------------------------------------------------


-- RobertGraham - 13 Feb 2004


FAQForm
FAQs.Class: NetworkAddressTranslationFAQs, TroubleshootingFAQs
FAQs.OS:
FAQs.Version: