Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

noc
New Member

PIX 525 is disallowing new connections

I am using PIX 525 running 6.2 to protect inside and dmz networks. I am using static NAT. The PIX is denying outbound connections from dmz as well as inside interfaces though implicit permit is already there. the log messages are:

"201008: The PIX is disallowing new connections.

305006:outbound static translation creation failed for tcp src ................

Please Help to resolve the issue.

5 REPLIES

Re: PIX 525 is disallowing new connections

Hi,

have a look at this url:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v51/syslog/pixemsgs.htm#xtocid5

and you will find this info:

%PIX-3-201008: The PIX is disallowing new connections.

Explanation

This message occurs when you have enabled TCP syslogging and the syslog server cannot be reached, or when using PFSS (PIX Firewall Syslog Server) and the disk on the Windows NT system is full.

Action

Disable TCP syslogging. If using PFSS, free up space on the Windows NT system where PFSS resides. Also make sure that the syslog host is up and you can ping the host from the PIX Firewall console. Then restart TCP syslogging to allow traffic.

%PIX-3-305006: type translation creation failed for protocol

Explanation

A protocol (UDP, TCP, or ICMP) failed to create a translation through the PIX Firewall. The type can be static, portmapped (PAT), or regular.

Action

This message can be either an internal error or an error in the configuration.

Kind Regards,

Tom

noc
New Member

Re: PIX 525 is disallowing new connections

Both the problems have been resolved. Thanks for your help.

Another issue is that I am able to ping from inside to DMZ but not been able to access other services like web/ftp etc. the log shows the following message:

302013:built outbound tcp connection 7 for DMZ

Where I am wrong?

Re: PIX 525 is disallowing new connections

Hi,

is it possible to post:

- the translation commands from the inside to the dmz

- the access-lists applied to the inside interface and the dmz interface

Thanks!

Kind Regards,

Tom

noc
New Member

Re: PIX 525 is disallowing new connections

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet3 DMZ security60

static (DMZ,outside) 192.168.1.2 192.168.1.2 netmask 255.255.255.255 0 0

static (inside,outside) 192.168.2.2 192.168.2.2 netmask 255.255.255.255 0 0

static (inside, DMZ) 192.168.2.2 192.168.2.2 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

access-group DMZ_access_in in interface DMZ

New Member

Re: PIX 525 is disallowing new connections

Check your NAT configuration, might be it is related to subnet mask .

And you should check your logging host or temporary disable forwarding cisco logs to the logging host.

Thong Do

114
Views
4
Helpful
5
Replies