Connection to PAT address without pre-existing xlate

Hello Experts,
We recently migrated to ASA 9.1.5 from ASA 8.6. Everything worked well except static object NAT. Let me make you understand with an example.
My inside host 10.12.7.93 is not able to do name resolution from 8.8.8.8. or 8.8.4.4.
object network 10-12-7-93
host 10.12.7.93
nat (INSIDE,OUTSIDE) static 199.96.217.225
end
Packet capture command output is shown below.
packet-tracer input inside udp 10.12.7.93 10056 8.8.8.8 53
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 OUTSIDE
Result:
input-interface: INSIDE
input-status: up
input-line-status: up
output-interface: OUTSIDE
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate
What i have observed is that there is a policy pat for destinations 8.8.8.8 and 8.8.4.4 for some inside hosts. Not that 10.12.7.93. What can be the issue? is it some bug in ASA 9.1.5? Your suggestions and comments will be really appreciated.

Karthik,
First of all thank you for the kind consideration.
I will test it without object NAT today and will share the result with you. I am pretty sure it will work that way. The issue is that it was all working well while using 8.6. We have production running and there are 40-50 object NATs running. I cannot afford to add all of them in NAT section 1. Cause this does not make any sense.Since the dynamic PAT is in section 3 and object NAT in section 2. So technically since my traffic matches in section 2 . It should implement that NAT instead of staying in NAT section 3.This is the NAT which is causing conflicts. But this is NAT section 3 and my object NAT for the host is in section 2.
nat (INSIDE,OUTSIDE) after-auto source dynamic LOWER-SEGMENT x.x.x.x destination static DNS-SERVERS DNS-SERVERS service DNS-TCP DNS-TCP
nat (INSIDE,OUTSIDE) after-auto source dynamic LOWER-SEGMENT x.x.x.x destination static DNS-SERVERS DNS-SERVERS service DNS-UDP DNS-UDP
LOWER-SEGMENT: Tthis object group carries the subnet 10.12.7.0/24
While my section 2 NAT is
object network 10-12-7-93
nat (INSIDE,OUTSIDE) static y.y.y.y
end

Similar Messages

Using airport time capsule to create an internet connected network from pre existing wifi network

i bought an airport time capsule for college. I bought it to create a network for my dorm room so that I could take the pre existing wifi from the school and make my own mini network that I can hook my other stuff up to. Problem is that I don't have an ethernet hook up in my room so the network would have to be created from a wifi network rather that a ethernet hook up. Is this still possible? Alternate suggestions? I am afraid of either the college network blocking users from communication with other devices via the wifi, or the fact that my printer would be on a huge network for all to screw with.

Is this still possible?
NO, it won't work. Apple only works with apple.
Alternate suggestions?
I am sure your college has rules about not running your own wifi networks.. but anyway.. that is up to you.. the Apple TC cannot turn off 2.4ghz which would be handy.. so the only way to do this following the rules is ethernet. You can run a full network standalone on ethernet. And still use wireless for internet.
If you want to use wireless standalone this is also possible but you need to connect a second wifi USB dongle your Mac so you can have two networks at once.. You can use an express to connect to the college wireless and bridge that to the TC by ethernet.. then use the TC to create your own network.. since you cannot turn off 2.4ghz I guess how long the College IT people take to track you down should be hours. If you could just use 5ghz it would probably be ok.

Safari opens links in new tabs, or in pre-existing tabs without giving me the option of opening the link in the same tab.

Safari opens links in new tabs, or in pre-existing tabs without giving me the option of opening the link in the same tab.
This has never happened before. Normally I would right-click and select open in new tab. How do I fix it? It's really frustrating.

Safari > Preferences > Tabs
"Open pages in tabs instead of windows:"
Click the box for drop down.
You have three choices, Never, Automatically and Always.
Pick your choice.

Restoring a db without an existing odbc connection

Hey all,
I'm looking for a way to restore a db as the first db in an
application I have written. The app normally restores DBs as a way
of automatically creating new sites, but if this is a new box and
code determines the main manager DB doesn't exist, how does one
restore a DB... without an existing ODBC to connect to the DB
server through? I'm talking specifically about SQL Server on
Win2003.
Any advice?

Ok. I gave up on trying to restore through code. Did it
manually and have what I think is a working DB, but I cannot
connect through CF
Connection verification failed for data source: NemoManager
java.sql.SQLException: [Macromedia][SQLServer JDBC
Driver]Error establishing socket. Connection refused: connect
The root cause was that: java.sql.SQLException:
[Macromedia][SQLServer JDBC Driver]Error establishing socket.
Connection refused: connect
Any ideas? Do I have to update Java or something? Sorry, I'm
a little dense when it comes to server stuff and Java.
Windows 2003 Server Enterprise
MS SQL Server 2005
CF 7

TLS over a pre-existing connection

I'm working on a mail server, and it would be nice if I could implement the STARTTLS commands for smtp (http://www.ietf.org/rfc/rfc3207.txt) and POP3 + IMAP (http://www.ietf.org/rfc/rfc2595.txt ). In order to do that, I need to do TLS negotiation over the pre-existing connection. I've never used SSL in Java before, but it looks like the javax.net.ssl package only supports starting SSL sockets from scratch, not starting TLS over existing sockets. I don't see any TLS stuff in the crypto package either. Is there any way to accomplish what I need?

javax.net.ssl.SSLSocketFactory.createSocket(Socket s,...)

Using WRT45G wireless router with a pre-existing network?

I am an NYU student, so I am already connected to a pre-existing network. However, I would like to have wireless internet in my room, so I bought the WRT45G router. Is it possible to do this? I don't have an actual, physical modem. There is just an internet jack in my room.

Yes. Simply hook up the Internet port of the WRT to the internet jack. Then plug your computer to a LAN port. Configure your WRT going to http://192.168.1.1/ (default password is "admin" unless you have changed that).
1. Set the router to "Automatic Configuration - DHCP".
2. Save Settings.
That should do it. You should be able to check the Status tab and see that the router got an IP address from your campus network.
For the security of your network and your computer I highly recommend to do the following things as well. Don't forget to save the settings for each page where you make changes.
- change the router password. You can do that on the Administration tab.
- change the SSID to something else than "linksys" on the Wireless tab.
- turn off the SSID broadcast after you have connected your computer for the first time wireless. (Wireless tab)
- turn on wireless security (on the wireless security subtab). Choose WPA2 Personal if possible (i.e. your computer allows it). Else WPA Personal. Choose TKIP or TKIP+AES depending on the setting before. Enter a pre-shared key (a stronger password or passphrase). You must enter the identical key in your computer when you connect the first time.
Without wireless security anyone can use your router and most likely is able to connect to your computer as well. Therefore: use it!

Stupid Question. Is a pre-existing wi-fi needed?

I was looking into the Apple Airports and was just wondering if you needed a pre-existing or is it a wi-fi in itself? I know that this is kinda a dumb question, but I won't find out without asking?
Thanks.

The AirPorts are wireless routers only. They will need to connect to a modem if you want to be able to access the Internet.
Your Internet Service Provider can supply you with a modem, which is probably also a wireless router, so you may not need an AirPort unless you just want to have an Apple router.

Error "Connection Failed The server may not exist or is not operational..."

This is just FYI in case somebody else runs across this. On one user account, an error window would pop up every so often that said:
Connection Failed
The server may not exist or it is not operational at this time. Check the server name or IP address and try again.
It turns out that the problem was caused by Screen Saver. The error popped up whenever screen saver tried to launch. On the problem account I had the "Pictures" folder selected for the screen saver, and apparently there must be an alias in that folder pointing to something on a remote server, because as soon as I go to System Preferences and open the Screen Saver panel, I get the error.
It has been driving me crazy for months but finally I thought to look in Console, where I saw the error "afp_mount[5045] CFLog (0): CFMessagePort: bootstrap_register(): failed 1103 (0x44f), port = 0x2d03, name = 'com.apple.afp_mount.ServiceProvider'"
Searching for that error led me to the Macosxhints forum at http://forums.macosxhints.com/archive/index.php/t-53209.html where a user had posted the same problem. Changing to a different screen saver or a different folder for pictures resolved the issue.
PowerMac G5 Mac OS X (10.4.6)
PowerMac G5 Mac OS X (10.4.6)

Welcome to discussions leffjay. Good one. Cheers.

Adding a single page to pre-existing website

I currently have a website running on Amazon S3 and want to add a page to the domain using Muse and do not want to replace the pre-existing website.
Example:
Current web address:
subsite.mywebsite.com
Desired address of Muse-created site:
subsite.mywebsite.com/musesite.html
subsite.mywebsite.com does not need to be modified in any way—my clients just need to be able to access musesite.html via a link using my brand's domain. Can this be accomplished using BusinessCatalyst provided hosting? If so, how can I accomplish this?

Hi Joseph,
You need to create the page in Muse and then export the html to a local folder on your computer and then upload the exported content on the root folder of your existing business catalyst site. You will not be able to use the web forms with this approach.
If you can host the site in a sub directory, then you can create the page in the Muse and then publish directly to a sub-directory on the root, this way you will be able to use the web forms.
- Abhishek Maurya

How do I find the ports a pre existing program used in DAQ?

Hi all,
I am setting up a laser displacement sensor and trying to utilize a pre existing program that was created by graduate students before me. There are 4 wires coming from the laser displacement sensor that need to be connected to the DAQ but we have no information telling us where these wires are supposed to attach to the DAQ in order to run the pre existing program correctly.
Is there any way that we could figure this out?
Thank you for your help,
mccutchen12c

James,
Thank you for your help! Yes, we have looked at a couple different methods on how to tell if the information had been programmed by the previous grad students and we haven't had any success in finding that information. So I believe you are right in assuming its not documented.. We will do a better job of documenting for future grad students after us.
I have attached our code. Any insight you could give would be greatly appreciated!
We have an Acuity AR200-6 laser displacement sensor with green, yellow, black and a wire that isn't wrapped that all lead to the serial port in the back of the computer and ground. We then have white, blue, orange and brown wires that do not have a location.. We did some research and the are as follows:
white: laser disable
blue: buttons disable
orange: voltage output
brown: voltage RTN
We are starting to wonder if we are just not supposed to use the DAQ.. Can you confirm the connection is solely through a serial port?
Cheers,
Carley

I have qualitynet either wired internet. I buy a card good for a month at a time, I can only log into one device at any one time. Are there settings I can adjust on my airport express to allow all my devices to connect to wi-fi without having to log out.

I have qualitynet either wired internet. I buy a card good for a month at a time, I can only log into one device at any one time. Are there settings I can adjust on my airport express to allow all my devices to connect to wi-fi without having to log out of one devise before using another?

Some Internet providers that limit access to a single device at a time do so by the device's hardware MAC address. If your ISP is one of those, you may be able to substitute the MAC address of your AirPort Express base station for the computer. I would suggest that you contact them to find out if this is allowable.

Windows storage server 2012 share not connecting by share name but connecting thru IP address from windows XP machines

We have a windows storage server 2012 (HP storage server) in our domain. All of sudden We had a issue, connecting the server shares using the share name only from XP machines, but it is connecting through IP address with a delayed response. We are getting
the below error message from all the windows XP SP2 machines in our domain.
"\\<share name> is not accessible. You might not have permission to use this network resource. Contact the administrator of this server to find out if you have a access permissions.
Login Failure: The target account name is incorrect."
But it is connecting while we are trying from windows 7 machines. Also the other server shares (Windows 2003 server) are connecting without any issues using the share name. In addition to this we gave everyone permission for this share. And it worked
well before but not now. Could you please suggest any solution for this complex issue?
Thanks,
UdayaKumar S

Hi,
We are getting the below critical alert mail often from our storage server. This could be the problem?
vent from Blade NODE01.*****.com, In Enclosure: EM-E83935ED70F6, Network Interface Lost Connectivity.
Description: "A network interface has failed. An Ethernet adapter's status changed from OK to Error, or an Ethernet team's status changed to Error from another state."
Source: CIM Indication from CSP Provider
Date: 02-06-2014 Time: 18:52:26
Blade: NODE01.****.com
NetworkAddresses:
Severity is Critical
Recommended Actions: Check the network cables, switches, and hubs for the cause of the failure.
Note: For More information please refer the Windows System Logs in the Event Viewer

Adding a character into a pre-existing filename; Bridge CS5.1

I would like to know if it is possible to add a character or in my case a ( Character & a Space ) in-between an already pre-existing sequential number
For example,
1301 Filename.jpg - - - - -> 13 01. Filename.jpg ( Added a ( Space ) inbetween the two numbers, and placed a ( Period ) aswell.
I would like to do this action to a group of files using the Batch Rename Feature; inside of Adobe Bridge CS5.1
Is this possible? Is there a work around?

I understand how string substitution works, you are misinterpreting the question.
I would like to change the number sequence from.
1301 Filename.jpg - - - - - - - -> 13 01. Filename.jpg
1302 Filename.jpg - - - - - - - -> 13 02. Filename.jpg
1303 Filename.jpg - - - - - - - -> 13 03. Filename.jpg
1304 Filename.jpg - - - - - - - -> 13 04. Filename.jpg
1305 Filename.jpg - - - - - - - -> 13 05. Filename.jpg
As you can see I would like to ( Add ) Characters not replace. the characters being a ( Space ) and a ( Period )
But if there is a way to replace all of my sequence numbers together, that would be a viable option aswell.As of now I am not aware of a substitution command that will get rid of say a four digit combonation of numbers no matter what the actuall numbers
That last sections of what you copy and pasted states there may be commands ( Expressions ) to replace filename patterns, but I am not aware of any specific commands ( Expressions ) I must type inside of the text bar to achieve the affect I am looking for.
Any pre-existing help on Expressions?
They are foreign to me and I would like to study the information for future use.
I will be searching Google, if by chance I come across information pertaining to this subject, I will let you know. As of now any help is much appreciated.
Ok I have figured out how to get rid of the string of numbers by using the Regular Expression of [0-9] but,
I still do not know how to add a ( space ) inbetween the numbers without doing it all manually.
Regular Expressions is the answer to my question, but now I have a new question. Which Regular Exresion do I use? It seems like it will take quite some time to get a good understanding of Regular Expressions, is there anyone who has a fair amount of knowledge on the subject who is willing to assist me in the mean time?

Problems connecting two wireless rooters without cable.

How do I set two Roter, if one is already configured.
The other is a model Edimax BR-6504n.
For the first Roter I know the MAC address and no password ... I connect with any laptop without the password, I am interested in someone who knows better to enlighten me.
I know from the manual that the rooter supports the following options:
AP
AP Bridge-Point to Point
AP Bridge-Point to Multi Point
AP Bridge-WDS
And in the MAC section of the AP Bridge-Point to Point I put the MAC of the first rooter, and here is the problem cause I do not know the channel of the first rooter. Is there a program or something that find the channel.
I have access only to the second rooter.
And it is important what options to set so that i reduce the number of combination to try when i put the channel.
What option should I put to the LAN? to make the ip different from the first rooter?
IP of first rooter: 192.168.2.100-200 I think this are the range ip of the first rooter.
Should I put the second rooter IP in another range like 192.168.1.*.* or leave it to 192.168.2.*.*?
The problem is that I must link them wireless not by wire.
So how do I connect the second rooter to the first so that I can extend the range of the wireless.
For those interested, here is found the user manual.
http://www.edimax.com/en/support_detail ... 2&pl1_id=1
Or just download the attached file.

In this mode, you canconnect your wireless rooter with another, to combine two access points and expend the scope of the wireless network, and all clients of two wireless rooter will think they'rw on the same physical network.....etc see the image below.
So i think it must work...but i du not know how to config them.
Look in this section.
[url=http://i.imagehost.org/view/0198/Capture_10][img]http://i.imagehost.org/0198/Capture_10.jpg[/img][/url]

Adding to ipod from alternative iTunes catalogue without erasing existing

Is it possible to add music to ipod without erasing existing content that was synced from another PC.
So far i have been alerted that if i sync any new material from my list it will automatically erase what my daughter already has on her ipod.

Connect your iPod to your computer. If it is set to update automatically you'll get a message that it is linked to a different library and asking if you want to link to this one and replace all your songs etc, press "Cancel". Pressing "Erase and Sync" will irretrievably remove all the songs from your iPod. When your iPod appears in the iTunes source list change the update setting to manual, that will let you use our iPod without the risk of accidentally erasing it. Check the "manually manage music and videos" box in Summary then press the Apply button:
Using iPod with Multiple computers
Managing content manually on iPod
Syncing Music to iPod
You can also use a keyboard command to prevent your iPod auto-syncing with iTunes. While connecting the iPod to the computer on Windows with iTunes 7.3 or later installed hold down the Shift + Ctrl keys together. This will stop the iPod from auto-syncing with iTunes and the iPod will appear in the source list. Wait until you are sure the iPod has mounted, and that it will not auto sync and then you can let the keys go. This may take between 20 to 30 seconds depending on your computer. Once you are connected you can change to manual as above: iTunes - Keyboard Shortcuts for Windows
Something else to be aware of when using an iPod in manual mode is that the "Do Not Disconnect" message will remain on the display until you physically eject the device: Safely Disconnect IPod

Connection to PAT address without pre-existing xlate

Similar Messages

Maybe you are looking for