Symptom

In an ASA cluster with at least 2 devices SSH and ICMP will fail with the following ASP drop should any unit other than the control node receive that traffic instead of being redirected to the control node as intended: - Connection to PAT address without pre-existing xlate (nat-no-xlate-to-pat-pool) A packet capture with trace enable will show the following: 1: 20:15:30.907027 802.1Q vlan#1000 P0 192.168.1.1.57432 > 192.168.2.1.22: S 1032924300:1032924300(0) win 65535 Phase: 1 Type: CAPTURE Subtype: Result: ALLOW Config: Additional Information: MAC Access list Phase: 2 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 3 Type: ROUTE-LOOKUP Subtype: Resolve Egress Interface Result: ALLOW Config: Additional Information: found next-hop 10.122.169.73 using egress ifc identity Result: input-interface: Outside input-status: up input-line-status: up output-interface: NP Identity Ifc Action: drop Drop-reason: (nat-no-xlate-to-pat-pool) Connection to PAT address without pre-existing xlate Interface configuration will be similar to the following: interface Port-channel1.1 nameif Outside security-level 0 ip address 192.168.2.1 255.255.255.0 This is seen with a dynamic NAT interface configuration that may look as follows: NOTE: These objects do not overlap with the network an admin is using SSH or ICMP from. object network Test_1 nat (Inside,Outside) dynamic interface object network Test_2 nat (Inside,Outside) dynamic interface object network Test_3 nat (Inside,Outside) dynamic interface object network Test_1 subnet 192.168.100.0 255.255.255.0 object network Test_2 subnet 192.168.200.0 255.255.255.0 object network Test_3 subnet 192.168.300.0 255.255.255.0

Conditions

- ASA devices are in a cluster of 2 or more. - SSH/ICMP traffic goes to any unit other than the control node - Dynamic interface NAT rules present overlapping with interface that uses SSH/ICMP

Workaround

- Remove the dynamic interface NAT rules - Replace the dynamic interface NAT rules using a specific IP to translate subnets to that does not overlap with the interface seeing the nat-no-xlate-to-pat-pool drops

Further Problem Description