09-14-2005 05:19 AM - edited 02-21-2020 12:23 AM
I'm having a problem when working with outside NAT. Maybe I haven't understood the concept of outside NAT properly.
Here's the lab situation:
Running PIX OS 6.3(3) and (5).
outside network: 192.168.0.0 /24
inside network: 10.0.0.0 /8
A customer has an inside host 10.0.0.2 statically NATted to the outside global of 20.0.0.2. So far so good, traffic flows correctly with the related access-lists.
What the customer now wants is, for initiated inbound traffic, to do inbound PAT and source translate every IP to a global of 30.0.0.3 (we're talking of outside NAT). After having done that, traffic flows can be established from any outside host to our inside host, on which we see that sessions will originate from 30.0.0.3.
The problem now: I can't initiate outbound traffic anymore, with the following log entry in the PIX log:
305005: No translation group found for tcp src inside:10.0.0.2/11009 dst outside:192.168.
0.2/8080
Why is that? We do have a static (inside,outside) that should be dealing with the translation, isn't it?
Any help is appreciated!! See the config below.
Thanks
Toni
---
pixfirewall(config)# sh run
: Saved
:
PIX Version 6.3(5)
interface ethernet0 auto
interface ethernet1 auto
nameif ethernet0 outside security0
nameif ethernet1 inside security100
enable password xxx
passwd xxx
hostname pixfirewall
fixup protocol dns maximum-length 512
fixup protocol ftp 21
fixup protocol h323 h225 1720
fixup protocol h323 ras 1718-1719
fixup protocol http 80
fixup protocol rsh 514
fixup protocol rtsp 554
fixup protocol sip 5060
fixup protocol sip udp 5060
fixup protocol skinny 2000
fixup protocol smtp 25
fixup protocol sqlnet 1521
fixup protocol tftp 69
names
access-list outside permit ip any host 20.0.0.2
access-list outside permit icmp any any
access-list inside permit icmp any any
access-list inside permit tcp any any eq 8080
access-list inside permit ip any any
access-list nat-outside permit ip any host 20.0.0.2
pager lines 24
logging on
logging buffered debugging
mtu outside 1500
mtu inside 1500
ip address outside 192.168.0.1 255.255.255.0
ip address inside 10.0.0.1 255.0.0.0
ip audit info action alarm
ip audit attack action alarm
pdm history enable
arp timeout 14400
global (inside) 1 30.0.0.3
nat (outside) 1 access-list nat-outside outside 0 0
static (inside,outside) 20.0.0.2 10.0.0.2 netmask 255.255.255.255 0 0
access-group outside in interface outside
access-group inside in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00
timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout sip-disconnect 0:02:00 sip-invite 0:03:00
timeout uauth 0:05:00 absolute
aaa-server TACACS+ protocol tacacs+
aaa-server TACACS+ max-failed-attempts 3
aaa-server TACACS+ deadtime 10
aaa-server RADIUS protocol radius
aaa-server RADIUS max-failed-attempts 3
aaa-server RADIUS deadtime 10
aaa-server LOCAL protocol local
no snmp-server location
no snmp-server contact
snmp-server community public
no snmp-server enable traps
tftp-server outside 192.168.0.2 /
floodguard enable
telnet timeout 5
ssh timeout 5
console timeout 0
terminal width 80
Cryptochecksum:xxx
: end
pixfirewall(config)#
09-20-2005 12:09 PM
%PIX-3-305005: No translation group found for protocol src: message signals a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the ACL bound to the nat 0 ACL.
09-20-2005 08:47 PM
according to the config above, there is no outside nat statement
access-list nat-outside permit ip any host 20.0.0.2
global (inside) 1 30.0.0.3
nat (outside) 1 access-list nat-outside outside 0 0
with these statements, the pix will nat any packet has a destination to 20.0.0.2 into 30.0.0.3. traffic with other destinations will not match the acl and that mean will not be natted. that's why no traffic can be initiated outbound. the only exception is 10.0.0.2 as it will be natted to 20.0.0.2
in order to achieve the outside nat, try
static (outside,inside) 30.0.0.3
howeever, it may not be feasible to do outside pat, i did only 1-to-1 nat
09-23-2005 12:52 AM
I have the same problem of outside. So I want to do a nat 1-to-1 translation. I have excecuted the:
When I executed:
static (outside,inside) 30.0.0.3 real_ip_lan netmask 255.255.255.255 0 0
I have seen that I can see the web site from inside with domain name but I can not see it from outside.
I have used an access-list:
access-list www permit tcp any host 30.0.0.3 eq www
and access-group www in interface outside
can you please help me?
thnx
09-23-2005 02:21 AM
Hi dritanulqinaku
I'm not quite sure of what you want to do. Can you tell us how you want to translate and in which direction you want to filter?
I interpret your config output this way:
- You want to translate the destination IP for a host sitting on the outside. Seen from the inside.
- Confusingly, you want to only permit www traffic coming from any host sitting on the outside to 30.0.0.3, which in turn is only accessible from the inside?
I think you need to bind the access-list to the inside interface:
access-group www in interface inside
Hope this helps...
Toni
09-23-2005 03:33 AM
hi dritanulqinaku,
are you trying to setup a web server located behind the firewall and allowing access from the internet? if so, you'll need the followings:
static (outside,inside)
plus the acl you've got already
09-23-2005 02:02 AM
Thanks for your reply, jackko.
Some things to point out:
- I'm aware that there is no nat (inside) 0 0.0.0.0 0.0.0.0 statement in my config. Yet, I've used it during the lab with no success.
- Your statement: "traffic with other destinations will not match the acl and that mean will not be natted" does only apply to inbound traffic. Yes, traffic won't be translated for initiated outbound connections from any to any as well, but this is due to the missing nat (inside) 0 statement. According to the tests in my lab, it won't change the problem if you entered it.
- I agree, the only exception that should be translated is 10.0.0.2 as it will be natted to 20.0.0.2. The thing is: it doesn't. See the error message I've already posted:
--> 305005: No translation group found for tcp src inside:10.0.0.2/11009 dst outside:192.168.
0.2/8080
- This error msg was generated while I Pinged from that mentioned source 10.0.0.2 to an outside host. Representing the reason for my confusion and this post.
I'd really be glad if someone could confirm the capability of the PIX to handle this kind of NAT. By now, no one could really prove it works.
09-23-2005 10:04 AM
just wondering if you did "clear xlate" as it's required when modifying any nat-related statement.
also do a "show xlate" and "debug icmp t" to verify whether the pix does perform the nat as expected as well as whether or not the traffic is being sent and received.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide