ASA 7.2 5510 portmap translation creation failed for tcp src inside

Answered Question
Nov 14th, 2008
User Badges:

Hi ive got a NAT problem, the asa shows up a the error: "portmap translation creation failed for tcp src inside" when trying to access a specific lan, here are the network config


OUTSIDE is xx.xx.xx.xx

TEMPNET is > NET behind tempnet is /24

The Problem is i have only 2 IPs i can use in Tempnet, so i have to NAT all my internal IPs to 1 IP from the TEMPNET, TEMPNet is provided by another company and got its own router which forwards pakets into several foreign networks, to prevent routing issues (tempnet routers dont know routes into my local net) i need to nat all my local ips to lets say

I added a route for example route tempnet /24 (1.2 is the router from the TEMPNET).

Now here are my nat / global / statements:

access-list NAT_TEMP permit ip

access-list NAT_ANYDESTINATION permit ip any

nat (inside) 1 access-list NAT_ANYDESTINATION

nat (inside) 2 access-list NAT_TEMP

global (inside) 1 interface

global (tempnet) 2 interface

when trying to access i receive the errorcode: portmap translation creation failed..

when i change this:

no nat (inside) 2 access-list NAT_TEMP

no global (tempnet) 2 interface

global (tempnet) 1 interface

it works like a charm, but why isnt it working with the other config, lets say i want to split it more up and work with more then 1 nat rules based on source and destination it wont work, why do i cannot use multiple nat/global statements?

Correct Answer by Jon Marshall about 8 years 8 months ago


This link suggests that it is the order that is important -


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Jon Marshall Fri, 11/14/2008 - 03:32
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN


Try swapping your nat statements around. I think the problem you face is that the firewall runs through the nat (inside) id access-list statements in order. And because

nat (inside) 1 access-list NAT_ANYDESTINATION

is the first statement this also matches any traffic going from -> So try this

nat (inside) 1 access-list NAT_TEMP

nat (inside) 2 access-list NAT_ANYDESTINATION

Jon Fri, 11/14/2008 - 03:42
User Badges:

Hi John,

i always thought pixOS will determine the "more specific" nat statement.

Like source host xxx to yyy nat is more specific as source subnet to any is less specific.

What do u think?


This Discussion