NATCCNA 200-301

NAT Asymmetric Routing — Packets Arriving on Wrong Interface

Presenting Symptom

Users report intermittent connectivity failures; traffic from certain sources fails to reach internal servers, while other traffic succeeds, and the NAT translations table shows entries with inconsistent interface mappings.

Network Context

A medium-sized enterprise campus network with a dual-homed edge: two Cisco ISR 4321 routers (R1 and R2) connect to separate ISPs for redundancy. Internal servers (10.0.1.0/24) are behind a pair of ASA firewalls. The routers perform NAT overload (PAT) for internal users. IOS version 16.9. The problem occurs when return traffic for a NAT session arrives on the router that did not perform the translation due to asymmetric routing.

Diagnostic Steps

Check NAT translations table

show ip nat translations

Pro Inside global      Inside local       Outside local      Outside global
--- 10.0.0.1:1234    10.0.1.10:1234    203.0.113.5:80     203.0.113.5:80
--- 10.0.0.2:5678    10.0.1.20:5678    198.51.100.3:443   198.51.100.3:443

Look for entries where the inside global IP matches the router's interface IP. If entries exist but traffic fails, note the interface on which the translation was created (use 'show ip nat statistics').

Identify which interface NAT is applied to

show ip nat statistics

Total active translations: 2 (0 static, 2 dynamic; 2 extended)
Outside interfaces: GigabitEthernet0/0/0, GigabitEthernet0/0/1
Inside interfaces: GigabitEthernet0/0/2
Hits: 1234  Misses: 5
Expired translations: 10
Dynamic mappings:
-- Inside Source
[Id: 1] access-list NAT permit 10.0.1.0 0.0.0.255
  refcount 2, pool: POOL1
    pool POOL1: netmask 255.255.255.0
      start 10.0.0.1 end 10.0.0.10
      type generic, total addresses 10, allocated 2 (20%), misses 0

Note the outside interfaces. If return traffic enters a different outside interface than the one used for the outgoing translation, the router will not perform NAT on the return packet, causing failure.

Examine routing table for return traffic path

show ip route 203.0.113.5

Routing entry for 203.0.113.5/32
  Known via "static", distance 1, metric 0
  Routing Descriptor Blocks:
  * 192.0.2.1, via GigabitEthernet0/0/0
      Route metric is 0, traffic share count is 1

Check if the route for the destination (outside global IP) points out a specific interface. If the return traffic from the server is sent to a different router (e.g., R2) due to a different default route, that router may not have the NAT entry.

Verify NAT entry on the other router

show ip nat translations | include 10.0.1.10

(no output)

If the other router shows no NAT entry for the inside host, it confirms asymmetric routing: the return packet arrived on a router that did not perform the translation.

Root Cause

Asymmetric routing: Outbound traffic from internal host 10.0.1.10 exits via R1 (NAT performed on R1), but the return traffic from the external server is routed to R2 due to different default routes or load balancing. R2 does not have the NAT translation entry, so it forwards the packet with the original destination (inside global IP) to the inside network, where the host does not recognize it, causing connectivity failure.

Resolution

Ensure that both routers share the same NAT state or that traffic flows symmetrically. For CCNA-level, the simplest fix is to configure static routes to force return traffic to the same router. Alternatively, use a stateful NAT solution like Cisco's Stateful NAT64 or a firewall cluster. Here, we adjust routing on R2 to send traffic destined to the inside global pool back to R1: On R2: conf t ip route 10.0.0.0 255.255.255.0 10.0.0.1 (point to R1's inside interface) end If both routers are doing NAT, consider using a single NAT router or implement NAT with HSRP and stateful failover (beyond CCNA scope).

Verification

On R1, run 'show ip nat translations' and confirm active translations. Then test connectivity from internal host to external server. Run 'show ip nat statistics' to see hits increasing. On R2, run 'show ip nat translations' and confirm no stale entries. Finally, run 'traceroute' from internal host to external server to verify symmetric path.

Prevention

1. Design network with symmetric routing: ensure that all traffic for a given flow uses the same path in both directions. 2. Use a single NAT device or a cluster that shares state. 3. Avoid using multiple NAT routers without stateful synchronization.

CCNA Exam Relevance

On the CCNA 200-301 exam, this scenario may appear as a troubleshooting question where you must identify why NAT is failing. The exam tests understanding that NAT requires symmetric routing; return traffic must arrive on the same router that performed the translation. A typical multiple-choice question might show a topology with two routers and ask why certain hosts cannot reach the internet.

Exam Tips

Remember that NAT is unidirectional; the router only translates packets that match its NAT rules on the correct interface. Asymmetric routing breaks this.

The 'show ip nat translations' command is key; if you see an entry but traffic fails, suspect routing asymmetry.

In the exam, look for clues like 'default route pointing to different next-hop' or 'load balancing' that cause asymmetric paths.

Commands Used in This Scenario

show ip nat statistics

Displays statistics about NAT translations, including active translations, hit counts, and configuration parameters, used to verify NAT operation and troubleshoot translation issues.

show ip nat translations

Displays the current active Network Address Translation (NAT) translations on the router, used to verify NAT operations and troubleshoot connectivity issues.

show ip route

Displays the current IP routing table on a Cisco router, used to verify routes, check next-hop addresses, and troubleshoot connectivity issues.

Test Your CCNA Knowledge

Practice with scenario-based questions to prepare for the CCNA 200-301 exam.

Practice CCNA Questions