03-23-2009 03:49 PM - edited 03-11-2019 08:09 AM
I am looking for information on what is the significance of type and code on syslog messages.
3 Mar 23 2009 22:42:36 305006 192.168.0.2 portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2 (type 8, code 0)
03-23-2009 09:09 PM
portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2
Here is some info for that 305006 message
http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4770951
ICMP message 0 is Echo Reply message and 8 is Echo message:
Have a look at icmp Types codes RFC-792
http://www.faqs.org/rfcs/rfc792.html
My interpretation for your syslog message seeing the source X.X.31.10 and destination it seems as icmp is comming perhaps from another router from the INSIDE of the ASA? can you provide info on your topology with regards to these two networks to help you better if there is a problem with communication between these two nets, but seems that source x.x.31.10 is from different source/network behind asa traversing the same INSIDE interface not directly connected to INSIDE, by which in this case if ou expect this hosts network x.x.31.0 to communicate with x.x.0.2 hots/network you will need to configure couple of nat exempt rules in addition to same security trafic intra interface command statemens.
Regards
03-24-2009 10:20 AM
Thanks for the reply. The 31.0 is an internal network and the 0.2 is and a remote site where the VPN terminates on the inside on a different router. The ICMP traffic is NMS related, but the 0.2 subnet does not exist. Is that why the portmap translation has failed?
03-24-2009 12:29 PM
Is that why the portmap translation has failed?
This means there is no translation defined in the asa for this traffic between the two hosts going through asa INSIDE interface.
if you are terminating an Ipsec tunnel somewhere in your inside interface by another device as you indicated and want the far end of the tunnel talk to hosts on your ASA inside 31.0 traversing INSIDE interface sort of like a U-turn for the traffic you would need to allow that traffic in asa through nonat exempt rule.
this would be an example:
access-list nonat_traffic extended permit ip X.X.0.0
same-security-traffic permit intra-interface
nat (INSIDE) 0 access-list nonat_traffic
03-25-2009 03:35 PM
Thanks for your assitance Jorge!
03-25-2009 06:05 PM
Wes, you're very welcome.
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: