Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Deny Inbound (No Xlate)

All,

I am getting this error message on my Kiwi Syslog:

Pix-3-106011: Deny inbound (No xlate) udp src inside: 10.5.5.1/161 dst inside 10.232.2.1/2858

I am pretty sure this my device is sending SNMP packets over to my network monitor server.

Any help would be appreciated.

  • Firewalling
4 REPLIES

Re: Deny Inbound (No Xlate)

This doesn't meant PIX is blocking the traffic, merely a notification. Your SNMP session should be still running fine.

Besides below explanation, we have seen this message appears when PIX is denying any translation for any connection/session between hosts within internal network itself.

%PIX-3-106011: Deny inbound (No xlate) string

The message will appear under normal traffic conditions if there are internal users that are accessing the Internet via a web browser. Anytime a connection is reset, when the host at the end of the connection sends a packet after the firewall receives the reset, this message will appear. It can typically be ignored.

Recommended Action: Disable this syslog message from getting logged to the syslog server by entering the no logging message 106011 command.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a008051a0cd.html#wp1052137

HTH

AK

Re: Deny Inbound (No Xlate)

This means there is no ROUTE ! If this snmp traffic should be routed through the PIX.

Probably you have a global route 10.0.0.0/8 pointing to the inside.

On which interface is that destination located ?

sincerely

Patrick

New Member

Re: Deny Inbound (No Xlate)

both are on the inside interface and I can ping each from the other.

Re: Deny Inbound (No Xlate)

Is your snmp stuffs still working? I belived it should. PIX is telling you no translation is required/established if both src/des is from the same internal segment. This message can be ignored

For routing issue, i.e no route, you normally see something like 'no route xxxx' in log messages.

My-2cents-opinion.

Cheers!

AK

3651
Views
0
Helpful
4
Replies