ASDM Syslog messages

wesleyfry · ‎03-23-2009

I am looking for information on what is the significance of type and code on syslog messages.

3 Mar 23 2009 22:42:36 305006 192.168.0.2 portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2 (type 8, code 0)

JORGE RODRIGUEZ · ‎03-23-2009

portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2

Here is some info for that 305006 message

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4770951

ICMP message 0 is Echo Reply message and 8 is Echo message:

Have a look at icmp Types codes RFC-792

http://www.faqs.org/rfcs/rfc792.html

My interpretation for your syslog message seeing the source X.X.31.10 and destination it seems as icmp is comming perhaps from another router from the INSIDE of the ASA? can you provide info on your topology with regards to these two networks to help you better if there is a problem with communication between these two nets, but seems that source x.x.31.10 is from different source/network behind asa traversing the same INSIDE interface not directly connected to INSIDE, by which in this case if ou expect this hosts network x.x.31.0 to communicate with x.x.0.2 hots/network you will need to configure couple of nat exempt rules in addition to same security trafic intra interface command statemens.

Regards

Jorge Rodriguez

wesleyfry · ‎03-24-2009

Thanks for the reply. The 31.0 is an internal network and the 0.2 is and a remote site where the VPN terminates on the inside on a different router. The ICMP traffic is NMS related, but the 0.2 subnet does not exist. Is that why the portmap translation has failed?

JORGE RODRIGUEZ · ‎03-24-2009

Is that why the portmap translation has failed?

This means there is no translation defined in the asa for this traffic between the two hosts going through asa INSIDE interface.

if you are terminating an Ipsec tunnel somewhere in your inside interface by another device as you indicated and want the far end of the tunnel talk to hosts on your ASA inside 31.0 traversing INSIDE interface sort of like a U-turn for the traffic you would need to allow that traffic in asa through nonat exempt rule.

this would be an example:

access-list nonat_traffic extended permit ip X.X.0.0 X.X.31.0

same-security-traffic permit intra-interface

nat (INSIDE) 0 access-list nonat_traffic

Jorge Rodriguez

wesleyfry · ‎03-25-2009

Thanks for your assitance Jorge!

JORGE RODRIGUEZ · ‎03-25-2009

Wes, you're very welcome.

Jorge Rodriguez