This article provides guidance on resolving issues where translated sessions experience failures without any successful connections.

It focuses on checking policy hit-counts and security policy configurations to identify potential causes.

Destination NAT translation hits increase without corresponding successful session counts.

show security nat destination rule WEB-DNAT

Destination NAT rule: WEB-DNAT

Rule-set: DNAT-RULESET

Rule-Id : 5

Rule position : 5

From zone : EXTERNAL

Destination addresses : 203.0.113.15 - 203.0.113.15

Destination port : 443 - 443

IP protocol : tcp

Action : WEB-SERVER-POOL

Translation hits : 1500000

Successful sessions : 0

Failed sessions : 1500000

Policy hit-count shows no hits on the expected policy, indicating traffic may be dropped by a different policy.

show security policies hit-count

Logical system: root-logical-system

Index From zone To zone Name Policy count

200 TRUSTED EXTERNAL ACCESS_POLICY 500000

998 EXTERNAL TRUSTED ACCESS_POLICY 0 <<<<<< 0 hit

Add Missing Addresses: under the security policy to allow expected translated traffic.

Validate Flow Session and Translation: After updating the policy, check flow session (show security flow session) and translation hits (show security nat destination rule WEB-DNAT) to confirm that traffic is routed through the intended policy.