i-Connex-100 and NAT

Hello there,

I'm using a SWE-DISH iPT with an integrated  i-Connex 100 modem.  My service provider is giving me a whole /28 of public IPs, so I have the lan interface plugged directly into my Cisco ASA 5540.

The outside interface of my firewall is directly connected to the iDirect modem, and I'm using the interface for general NAT translations.  (Global nat interface)  I have several clients that I want static translations for, so I've configured several statics.

My problem is this.  I can't get IP traffic to pass on any ip other than the firewall interface.  For example, I changed my global nat from interface to the third usable ip on the subnet and the translations stop working.  I change the firewall outside interface to the very same IP that wasn't working, and everything runs like a champ.

When I telnet to the modem and use the "spoof debug on" command I see the following for the connections that don't work"

New transmit CID: 419, (base 419)
Spoof session created (lclpkt), 17 exist
x.x.3.45.3671 --> 64.191.203.30.80
Spoof rx remote packet, session with cid 2814 not found
Associating rx cid 2814 with Session:
x.x.3.45.3671 --> 64.191.203.30.80

and a while later, this shows up..

SpoofSession: killing session because retry limit reached m_Va=3352089621, m_Ns=3352089622, m_retx.size=1
SpoofMgr:ProcessSessionTimeout syn idle expires

Good connections happen like this:

New transmit CID: 555, (base 555)
Spoof session created (lclpkt), 6 exist
x.x.3.34.2510 --> 64.191.203.30.80
Spoof rx remote packet, session with cid 2922 not found
Associating rx cid 2922 with Session:
x.x.3.34.2510 --> 64.191.203.30.80

...
SPOOF FIN: tx FIN from local to remote (1395884124)
x.x.3.34.2510 --> 64.191.203.30.80
SPOOF FIN: rx FIN ack from remote (1395884124)
x.x.3.34.2510 --> 64.191.203.30.80
SPOOF FIN: tx FIN from remote to local (123458)
x.x.3.34.2510 --> 64.191.203.30.80
SPOOF FIN: tx FIN ack from local to remote (123458)
x.x.3.34.2510 --> 64.191.203.30.80

Spoof Session Dead:
x.x.3.34.2510 --> 64.191.203.30.80
Unlink rxCID: 2922
Unlink transmit CID: 555


So it looks like to me that it's a syn timeout problem.  I'm not convinced that the traffic is actually passing through the modem onto the sat link because the nat clients that don't work can't even ping the gateway.

Does anyone else have any other debugging tools that I could use to figure this out?  Any way to get a tcp dump of the traffic that's crossing the sat0 interface?

Could the spoofing config be breaking this?  Any help would be greatly appreciated.

Andrew

Thanks for the tips, Mike.  I decided to get a 3750 switch out and connect the iDirect to some clients in a vlan. Everything worked like a champ.  This could be some sort of ARP problem with the ASA.  I'm about connect the firewall to the same switch, so I'll let you know how that turns out.

Andrew

Glad to hear you are chasing ghosts!  I think we have all experienced that....