Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a Cisco ASA5510 where we have to separate networks on two separate interfaces.

The networks should have nothing to do with each other except that network B needs to access a printer on network A.

Network A:
Network B:

I've added an incoming rule from Network A to the Printer IP in the ASDM interface but clients can't print.

Our previous router was configured to let traffic through so the clients on Network B is already configured so it think it should work if traffic is allowed.

How do I let clients on Network B communicate with the printer?


Found the following inte the firewall log (thanks to resmon6):

%ASA-5-305013: Asymmetric NAT rules matched for forward and reverse flows; Connection protocol src interface_name:source_address/source_port [(idfw_user)] dst interface_name:dst_address/dst_port [(idfw_user)] denied due to NAT reverse path failure. An attempt to connect to a mapped host using its actual address was rejected.

I'm new to ASA so please bear with me, I guess i should add a NAT rule in the Configuration> Firewall > NAT Rules but what settings should it have to allow only the printer to be translated?


This is the current NAT-rules:

Result of the command: "show run nat"

nat (NetworkA) 101
nat (NetworkB) 101
nat (NetworkC) 101

Result of the command: "show run global"

global (outside) 101 interface

Result of the command: "show run static"

The command has been sent to the device
share|improve this question
These are all private networks... why do you need NAT on these sources to begin with? Are there problems with overlapping address space, or a need to identify traffic with a specific IP address? – Mike Pennington Jun 28 '12 at 11:18
I'm not sure if I need it, i thought so since the firewall said there was a NAT issue. All I need is to be able to access the printer from Network B. – Jonas Stensved Jun 28 '12 at 11:26
Jonas, did you put NAT on the FW, or was it there when you started working on the problem? If the former, then remove NAT. If the latter, then find the person who put it there and figure out what it's there for. – Mike Pennington Jun 28 '12 at 11:27
It was already there. I'll try to contact the one who put it there. – Jonas Stensved Jun 29 '12 at 8:43

You should look at the firewall logs when you are trying to print to the server to see if you're missing any ACL rules. A good way to do this is in ASDM under the monitoring=>logging sections.

You need to add a static NAT translation from NetworkA to NetworkB for that printer. The CLI command for this would be static (NetworkA,NetworkB) netmask

share|improve this answer
Thanks. I've updated my question with the results. It seems to be a NAT issue. – Jonas Stensved Jun 28 '12 at 8:47
Can you post your nat configuration? – resmon6 Jun 28 '12 at 12:51
Yes, how do I export it i a readable format? – Jonas Stensved Jun 29 '12 at 8:43
login through the command line and do a show run nat, show run global and show run static. You can do this from ASDM using the Tools>Command Line Interface menu. – resmon6 Jun 29 '12 at 12:29
Thanks. I've updated the question with the results. – Jonas Stensved Jun 29 '12 at 14:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.