Hi,
I am using a FWSM 3.1(5), in routed mode, with multiple contexts. This was the configuration before any changes were done: ----- access-list DMZ1-NAT extended permit ip any 192.168.0 255.255.0.0 access-list DMZ1-NAT extended permit ip any 10.0.0.0 255.0.0.0 access-list DMZ1-NAT extended permit ip any 172.16.0.0 255.240.0.0 access-list DMZ1-NAT extended deny ip any any nat-control global (OUT) 1 21.9.1.40 nat (DMZ1) 0 access-list DMZ1-NAT tcp 1000 1000 udp 1000 nat (DMZ1) 1 10.10.10.0 255.255.255.0 static (DMZ1,OUT) tcp 21.9.1.40 49151 10.10.1.201 49151 netmask 255.255.255.255 static (DMZ1,OUT) udp 21.9.1.40 49151 10.10.1.201 49151 netmask 255.255.255.255 ----- I removed the following part: ----- no static (DMZ1,OUT) udp 21.9.1.40 49151 10.10.10.201 49151 netmask 255.255.255.255 no static (DMZ1,OUT) tcp 21.9.1.40 49151 10.10.10.201 49151 netmask 255.255.255.255 ----- Exactly one hour later, DMZ1 could not send/receive traffic to/from the OUT zone any more. However, DMZ1 could still access any other zones, where no translation were needed The traffic to/from the OUT zone was then silently dropped by the firewall without showing anything at all in the syslogs. Doing a clear xlate did not solve the problem. Doing a clear conn did not solve the problem. Doing the following solved the problem: ----- no global (OUT) 1 21.9.1.40 global (OUT) 1 21.9.1.40 ----- Beside the explanation of why did this happen, I would like to know if this is related to a bug, in which case I will have to upgrade the OS or if this is due to a mis-configuration? Thank you for your time. Christophe _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
