Create a Post
cancel
Showing results for 
Search instead for 
Did you mean: 
Highlighted

NAT problem

Jump to solution

Hello

 

A week or so ago we changed an ip address on one of our interfaces from 10.157.1.10 to 10.184.0.2 we also changed the NAT rules that was configured to the old ip address. 

But now still the firewall sends packets with the old ip of 10.157.1.10 and 12 even when those addreses are unconfigured.

Running R80.20 with HFA 103

 

//Johan

 

0 Kudos
1 Solution

Accepted Solutions
Highlighted

Please provide a log screenshot of accepted traffic still being NATted to the old address, the log card will show the NAT rules involved.  Keep in mind that after changing a NAT address only new connections will start using it, old connections will continue using the old NAT address until they end.  Are sure you are launching NEW connections for testing and not still riding on old ones?

 

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com

View solution in original post

8 Replies
Highlighted
Is this part of a cluster? Did you change the IP's in clish and in SmartConsole?
Regards, Maarten
0 Kudos
Highlighted

Yes its a VSX cluster with two physical GWs and two VSes, the change was made in SmartConsole.

//Johan

0 Kudos
Highlighted
So you changed the IP in the VS object, did you also push the policy? Both VS and VSX cluster would be best to push, normally only the VS policy needs to be pushed, but it wont hurt to also push the Cluster itself as well.
Regards, Maarten
0 Kudos
Highlighted

Yes we have pushed VS policy several times and the cluster policy once now, but still the old ip address is used.

 

//Johan

0 Kudos
Highlighted
Admin
Admin

Any chance you have proxy arp in place?

 

 

0 Kudos
Highlighted

Yes the automatic default Proxy ARP is enabled and the Merge Manual setting too, however in the local.arp file there is only one entry with the new ip address in it.

 

//Johan

0 Kudos
Highlighted

Please provide a log screenshot of accepted traffic still being NATted to the old address, the log card will show the NAT rules involved.  Keep in mind that after changing a NAT address only new connections will start using it, old connections will continue using the old NAT address until they end.  Are sure you are launching NEW connections for testing and not still riding on old ones?

 

R80.40 addendum for book "Max Power 2020" now available
for free download at http://www.maxpowerfirewalls.com

View solution in original post

Highlighted
Thank you we look into that!

//Johan
0 Kudos