topic Re: NAT problem in Firewall and Security Management

NAT problem

Johan_Rudberg — Tue, 22 Oct 2019 07:45:35 GMT

Hello

A week or so ago we changed an ip address on one of our interfaces from 10.157.1.10 to 10.184.0.2 we also changed the NAT rules that was configured to the old ip address.

But now still the firewall sends packets with the old ip of 10.157.1.10 and 12 even when those addreses are unconfigured.

Running R80.20 with HFA 103

//Johan

Re: NAT problem

Maarten_Sjouw — Tue, 22 Oct 2019 08:29:02 GMT

Is this part of a cluster? Did you change the IP's in clish and in SmartConsole?

Re: NAT problem

Johan_Rudberg — Tue, 22 Oct 2019 08:31:03 GMT

Yes its a VSX cluster with two physical GWs and two VSes, the change was made in SmartConsole.

//Johan

Re: NAT problem

Maarten_Sjouw — Tue, 22 Oct 2019 08:42:12 GMT

So you changed the IP in the VS object, did you also push the policy? Both VS and VSX cluster would be best to push, normally only the VS policy needs to be pushed, but it wont hurt to also push the Cluster itself as well.

Re: NAT problem

Johan_Rudberg — Tue, 22 Oct 2019 09:02:43 GMT

Yes we have pushed VS policy several times and the cluster policy once now, but still the old ip address is used.

//Johan

Re: NAT problem

_Val_ — Tue, 22 Oct 2019 09:20:40 GMT

Any chance you have proxy arp in place?

Re: NAT problem

Johan_Rudberg — Tue, 22 Oct 2019 10:14:21 GMT

Yes the automatic default Proxy ARP is enabled and the Merge Manual setting too, however in the local.arp file there is only one entry with the new ip address in it.

//Johan

Re: NAT problem

Timothy_Hall — Tue, 22 Oct 2019 13:42:46 GMT

Please provide a log screenshot of accepted traffic still being NATted to the old address, the log card will show the NAT rules involved. Keep in mind that after changing a NAT address only new connections will start using it, old connections will continue using the old NAT address until they end. Are sure you are launching NEW connections for testing and not still riding on old ones?

Re: NAT problem

Johan_Rudberg — Tue, 22 Oct 2019 14:24:45 GMT

Thank you we look into that!

//Johan