Lighthouse has a new layout. Prefer the old one? Return to the old layout, and switch back any time from the link at the top of each page.

Report failed for policy NAT statements

#17

If I have a policy NAT statement in the configuration which has to be reported, the report failed.

This is the statement:
static (ncc,outside) 10.140.1.0 access-list ncc_nat_static
The access-list is defined as:
access-list ncc_nat_static extended permit ip 10.140.1.0 255.255.255.0 192.168.200.48 255.255.255.240

If I delete this statement, the report is working.

Reported by securantakra · April 16th, 2010 @ 12:11 PM

State: open
Milestone: none
Assigned to: Craig Bugzefsky Craig Bugzefsky

Activity

  1. Craig Bugzefsky
    Craig Bugzefsky
    • State changed from new to open

    This is a known issue, Flint does not comprehend ACL based NAT rules at this time.

    How does this fail for you tho, it should just not comprehend the NAT mapping, but continue to analyze the rest of the firewall.

    April 16th, 2010 @ 07:22 PM

  2. securantakra
    securantakra

    The report failed with the following message:

    application error
    Flint::LineError at /upload
    Error analyzing static <>

    wrong number of arguments (1 for 2)

    * file: range_set.rb
* location: initialize
* line: 234

    Is this feature planned for future releases, or have a workaround. The report is only running if I delete alle ACL based NAT statements.
    Kind regards

    April 21st, 2010 @ 09:55 AM

  3. Craig Bugzefsky
    Craig Bugzefsky

    Lighthouse <no-reply@lighthouseapp.com> writes:

    Unfortuantely, I cannot think of a workaround at this time.

    Deleting all ACL lines does make it work, but it's going to give you
    some incorrect results, particularly the set of hsots that can speak a
    given protocol thru the firewall.

    It is planned for a future release, and I'll try to prioritize this.
    The machinery to manage ACL NAT is there, we just haven't had time to
    hook it all up.

    April 21st, 2010 @ 02:37 PM

Please Sign in or create a free account to add a new ticket.

With your very own profile, you can contribute to projects, track your activity, watch tickets, receive and update tickets through your email and much more.