Routing internal traffic destined for the external interface of a PIX

[blongden1]

Next up - If someone on my internal network tries to access the external interface on the PIX which is set to forward web traffic to an internal server, the pix fails with an error:

Regular translation creation failed for tcp src inside:192.168.252.69/2711 dst inside:213.254.xx.xx/80

Do I need some sort of static to route the inside traffic to the correct place?

I'll get to grips with this one day, i'm sure...

[jmia]

Hello Ben...

Whats the PIX error log ID number.. i.e. %PIX-

Thanks - Jay.

[blongden1]

%PIX-3-305006

Gives me 3 identical errors.

[jmia]

Ben -

Thanks for that, also forgot to ask which PIX IOS version are you running?

Jay.

[jmia]

Ben,

The log ID is this -

Log Message %PIX-3-305006: type translation creation failed for protocol

Explanation > A protocol (UDP, TCP, or ICMP) failed to create a translation through the PIX Firewall. The type can be static, portmapped (PAT), or regular.

Recommended Action > This message can be either an internal error or an error in the configuration.

I think in your case it's likely to be with a static translation config error, can you post your PIX config (remember to change passwords + IPs)

Thanks - Jay.

[blongden1]

PIX Version 6.3(1)

interface ethernet0 auto

interface ethernet1 100full

nameif ethernet0 outside security0

nameif ethernet1 inside security100

enable password xxx encrypted

passwd xxx encrypted

hostname phoenix

domain-name xxx

fixup protocol ftp 21

fixup protocol h323 h225 1720

fixup protocol h323 ras 1718-1719

fixup protocol http 80

fixup protocol ils 389

fixup protocol rsh 514

fixup protocol rtsp 554

fixup protocol sip 5060

fixup protocol sip udp 5060

fixup protocol skinny 2000

fixup protocol smtp 25

fixup protocol sqlnet 1521

names

access-list outside_access_in permit tcp any any eq www

access-list outside_access_in permit tcp any any eq ftp

access-list outside_access_in permit tcp any any eq smtp

access-list outside_access_in permit tcp any any eq ssh

access-list outside_access_in permit icmp any any echo-reply

access-list outside_access_in permit icmp any any unreachable

access-list outside_access_in permit icmp any any time-exceeded

pager lines 24

logging on

logging trap warnings

logging facility 1

logging device-id hostname

logging host inside 192.168.252.86

mtu outside 1500

mtu inside 1500

ip address outside 213.254.xxx.xxx 255.255.255.240

ip address inside 192.168.252.40 255.255.255.0

ip audit info action alarm

ip audit attack action alarm

pdm location 192.168.252.71 255.255.255.255 inside

pdm location 192.168.252.86 255.255.255.255 inside

pdm logging informational 100

pdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

static (inside,outside) tcp interface ftp 192.168.252.71 ftp netmask 255.255.255.255 0 0

static (inside,outside) tcp interface smtp 192.168.252.71 smtp netmask 255.255.255.255 0 0

static (inside,outside) tcp interface ssh 192.168.252.71 ssh netmask 255.255.255.255 0 0

static (inside,outside) tcp interface www 192.168.252.71 www netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

route outside 0.0.0.0 0.0.0.0 213.254.181.129 1

timeout xlate 0:05:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 rpc 0:10:00 h225 1:00:00

timeout h323 0:05:00 mgcp 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server TACACS+ protocol tacacs+

aaa-server RADIUS protocol radius

aaa-server LOCAL protocol local

http server enable

http 192.168.252.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server community public

no snmp-server enable traps

floodguard enable

telnet 192.168.252.0 255.255.255.0 inside

telnet timeout 30

ssh timeout 5

console timeout 0

dhcpd address 192.168.252.42-192.168.252.169 inside

dhcpd lease 3600

dhcpd ping_timeout 750

dhcpd auto_config outside

terminal width 80

I am also getting the same error when someone attempts to connect from the internal network to a VPN. Message is:

%PIX-3-305006: regular translation creation failed for protocol 47 src inside:192.168.252.202 dst outside:xxx.xxx.xxx.xxx

Thanks for your help!

[blongden1]

Solved the VPN problem with "fixup protocol PPTP 1723". No joy with internal traffic destined for the outside interface of the pix routing to the correct internal server yet though.

[mpalardy]

You may add this to tour config:

access-list inside_access_in permit tcp host 192.168.252.69 host 213.254.xx.xx eq 80

access-group inside_access_in in interface inside

In order to make it work you will also need a "nat" and a "global" statement.

Mike