Unresolved Dynamic Object causes NAT rule matching to fail and packet drop
- Unresolved Dynamic Object causes NAT rule matching to fail and packet drop.
- In the kernel debug we see the following drops:
;18Sep2015 8:25:57.464175;[cpu_13];[fw4_2];fw_xlate_find_all_matches: Returning 2 for resolving of dynamic object;
;18Sep2015 8:25:57.464178;[cpu_13];[fw4_2];fw_xlate_match: Returning vanish or hold (2) for dynamic object resolving;
;18Sep2015 8:25:57.464194;[cpu_13];[fw4_2];fw_log_drop_ex: Packet proto=1 [IP Address:Port] -> [NATTed IP Address:Port] dropped by fw_first_packet_xlation Reason: Dynamic object is already being resolved;
- Even if there is a matching rule with a higher priority (and no issues), a rule with a lower priority that fails to resolve a dynamic object will cause the rule matching to fail and drop the packet.
Note: To view this solution you need to