Cisco Support Community
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

NAT behavior on FWSM 4.0

Hi all,

I have a question about NAT behavior on FWSM 4.0. The problem is email server (Company A) cannot connect to email gateway (Company B) on the outside network and it randomly happen. I got this error from server guy "Detail: xlate has blocked the connection between A’s mail gateway and B’s mail gateway". It work fine again after clear xlate on firewall.


FW-INTERNET# sh xlate global debug

Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,

       o - outside, r - portmap, s - static

32908 in use, 33983 most used

NAT from inside: to inside: flags Ii idle 0:00:06 timeout 3:00:00 connections 24

NAT from outside: to outside: flags Ii idle 2:31:38 timeout 3:00:00 connections 0

FW-INTERNET# sh conn foreign    

65010 in use, 87131 most used

Network Processor 1 connections

TCP outside inside idle 0:00:03 Bytes 1680666 FLAGS - UBOIX

Network Processor 2 connections 

TCP outside inside idle 0:00:27 Bytes 680 FLAGS - UIX

TCP outside inside idle 0:00:00 Bytes 7970592 FLAGS - UOIX

TCP outside inside idle 0:00:00 Bytes 416316 FLAGS - UOIX

TCP outside inside idle 0:00:00 Bytes 1413646 FLAGS => email gateway - Company B => email gateway - Company A


1. How FWSM create xlate table like that? I mean it look like NAT0 for but it doesn't has any nat rule for on firewall.

2. What does it mean "connections 24" at the first of line? In the normal time, I only see the connections is 0 like the second line of xlate

3. After clear xlate global, the first line of xlate table is gone then email server can connect each other. Does is a bug on FWSM? or This is a normal NAT behavior of FWSM.

Everyone's tags (3)

Re: NAT behavior on FWSM 4.0

Hi Bro

For some reason, your XLATE table is filled up. Hence, Email Server A (INSIDE) can’t communicate with Email Server B (OUTSIDE). I doubt this is a bug issue. I believe you’ve high network traffic/volume between INSIDE to OUTSIDE. Hence, this is affecting the communication between Email Server A (INSIDE) and Email Server B (OUTSIDE). Please do ensure your xlate timeout value isn’t modified, and kept to default i.e. 3 Minutes “timeout xlate 3:00:00”.

Listed below are some commands that you could type to investigate this issue further;

a)    show np block (hardware buffer counters) - if they are non-zero and increasing it's bad. You're most likely running into hardware limitation of the FWSM.

b)    show np all stats | i RTL and show np all stats | i RL will show you if the packets are dropped because of software rate limiting mechanisms built into network processors.

Perhaps, what you need is to enable the “xlate-bypass” command. By default, the FWSM creates NAT sessions for all connections even if you do not use NAT. You can disable NAT sessions for untranslated network traffic, which is called xlate bypass, in order to avoid the maximum NAT session limit. The xlate-bypass command can be configured as shown:


If the xlate-bypass doesn’t resolve your issue, please do ensure you’ve a static NAT or dedicated nat/global in place.

static (inside,outside)

Public IP Email Server A :

Private IP Email Server A :

The last resort is to enable sysoption np completion-unit, this magic option is invoking special processing created to address scenarios in which FWSM was known to introduce out of order packets for TCP streams.

P/S: If you think this comment is useful, please do rate them nicely :-)

Warm regards, Ramraj Sivagnanam Sivajanam Technical Specialist/Service Delivery Manager – Managed Service Department
CreatePlease to create content