Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASDM Syslog messages

I am looking for information on what is the significance of type and code on syslog messages.

3 Mar 23 2009 22:42:36 305006 192.168.0.2 portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2 (type 8, code 0)

5 REPLIES

Re: ASDM Syslog messages

portmap translation creation failed for icmp src INSIDE:X.X.31.10 dst INSIDE:X.X.0.2

Here is some info for that 305006 message

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4770951

ICMP message 0 is Echo Reply message and 8 is Echo message:

Have a look at icmp Types codes RFC-792

http://www.faqs.org/rfcs/rfc792.html

My interpretation for your syslog message seeing the source X.X.31.10 and destination it seems as icmp is comming perhaps from another router from the INSIDE of the ASA? can you provide info on your topology with regards to these two networks to help you better if there is a problem with communication between these two nets, but seems that source x.x.31.10 is from different source/network behind asa traversing the same INSIDE interface not directly connected to INSIDE, by which in this case if ou expect this hosts network x.x.31.0 to communicate with x.x.0.2 hots/network you will need to configure couple of nat exempt rules in addition to same security trafic intra interface command statemens.

Regards

New Member

Re: ASDM Syslog messages

Thanks for the reply. The 31.0 is an internal network and the 0.2 is and a remote site where the VPN terminates on the inside on a different router. The ICMP traffic is NMS related, but the 0.2 subnet does not exist. Is that why the portmap translation has failed?

Re: ASDM Syslog messages

Is that why the portmap translation has failed?

This means there is no translation defined in the asa for this traffic between the two hosts going through asa INSIDE interface.

if you are terminating an Ipsec tunnel somewhere in your inside interface by another device as you indicated and want the far end of the tunnel talk to hosts on your ASA inside 31.0 traversing INSIDE interface sort of like a U-turn for the traffic you would need to allow that traffic in asa through nonat exempt rule.

this would be an example:

access-list nonat_traffic extended permit ip X.X.0.0 X.X.31.0

same-security-traffic permit intra-interface

nat (INSIDE) 0 access-list nonat_traffic

New Member

Re: ASDM Syslog messages

Thanks for your assitance Jorge!

Re: ASDM Syslog messages

Wes, you're very welcome.

416
Views
0
Helpful
5
Replies
CreatePlease login to create content