NAT problem

[Johan_Rudberg]

Hello

A week or so ago we changed an ip address on one of our interfaces from 10.157.1.10 to 10.184.0.2 we also changed the NAT rules that was configured to the old ip address. 

But now still the firewall sends packets with the old ip of 10.157.1.10 and 12 even when those addreses are unconfigured.

Running R80.20 with HFA 103

//Johan

[Maarten_Sjouw]

Is this part of a cluster? Did you change the IP's in clish and in SmartConsole?

[Johan_Rudberg]

Yes its a VSX cluster with two physical GWs and two VSes, the change was made in SmartConsole.

//Johan

[Maarten_Sjouw]

So you changed the IP in the VS object, did you also push the policy? Both VS and VSX cluster would be best to push, normally only the VS policy needs to be pushed, but it wont hurt to also push the Cluster itself as well.

[Johan_Rudberg]

Yes we have pushed VS policy several times and the cluster policy once now, but still the old ip address is used.

//Johan

[_Val_]

Any chance you have proxy arp in place?

[Johan_Rudberg]

Yes the automatic default Proxy ARP is enabled and the Merge Manual setting too, however in the local.arp file there is only one entry with the new ip address in it.

//Johan

[Timothy_Hall · Accepted solution]

Please provide a log screenshot of accepted traffic still being NATted to the old address, the log card will show the NAT rules involved.  Keep in mind that after changing a NAT address only new connections will start using it, old connections will continue using the old NAT address until they end.  Are sure you are launching NEW connections for testing and not still riding on old ones?

[Johan_Rudberg]

Thank you we look into that!

//Johan