General

This bug identifies the same problem as CSCtq47028. CSCtq47028 is listed as resolved, but did not in fact resolve this problem, hence this bug is filed to continue to track it.

Symptom

In ASA 8.3 and later, Manual NAT rules (Section 1) may not be processed in the order they appear in the output of show running-config nat and show nat. In certain cases, a rule which performs a translation between 2 objects/object-groups will take precedence over a rule that does not perform any translation.

Conditions

The ASA must be running a software version of 8.3 or higher. The following is an example of an affected configuration: object-group network src-networkA network-object 10.1.1.0 255.255.255.0 object-group network src-networkB network-object 10.2.2.0 255.255.255.0 object-group network dst-networkA network-object 192.168.1.0 255.255.255.0 object network dst-hostA host 172.16.1.1 object network obj_any subnet 0.0.0.0 0.0.0.0 ! nat (inside,outside) source static src-networkA src-networkA destination static dst-networkA dst-networkA nat (inside,outside) source dynamic src-networkA interface destination static obj_any dst-hostA In the above example, a packet with a source of a host in src-networkA and a destination of a host in dst-networkA will NOT be processed by the 1st line, and instead will match the 2nd line and be translated.

Workaround

As a workaround, NAT rules can be modified to prevent this condition by avoiding re-using objects/object-groups in a single rule. Using the above example, the NAT rules could be changed to the following, thereby causing the 1st NAT rule to be applied to the previously indicated traffic flow: object-group network src-networkA-mapped network-object 10.1.1.0 255.255.255.0 object-group network dst-networkA-mapped network-object 192.168.1.0 255.255.255.0 nat (inside,outside) source static src-networkA src-networkA-mapped destination static dst-networkA dst-networkA-mapped nat (inside,outside) source dynamic src-networkA interface destination static obj_any dst-hostA Notice that no object/object-group is re-used within the same rule. This will force the ASA to process the NAT rules in the order they appear in the configuration.

Further Problem Description