I have found the problem. Is my nat config. if i get the pool out of nat, then i can reach.
My nat acl is very simple, i have tried to deny traffic to local address on acl but do not work.
my nat rule is:
service-location 1
location slot 3
#
service-instance-group NAT-1
service-location 1
#
nat instance NAT-1 id 1
service-instance-group NAT-1
nat address-group NAT-1 group-id 1
section 1 189.XXX.XXX.0 mask 26
section 2 189.XXX.XXX.0 mask 25
nat statistics address-pool-usage enable
nat log send-mode session-end-only
#
acl number 3001
rule 100 permit ip source 100.66.0.0 0.0.255.255
#
# on the interface
nat bind acl 3001 instance NAT-1 precedence 0
on cisco router i do something like this:
!
ip access-list extended nat-acl
deny ip 100.66.0.0 0.0.63.255 189.XXX.XXX.0 0.0.15.255
permit ip 100.66.0.0 0.0.63.255 any
!
and works, i have tried on ne40 without success.