topic Hi,Output of "show nat pool" in Network Security

portmap translation creation failed for tcp src inside:10.x.x.x/ dst outside:

andrewdours — Tue, 12 Mar 2019 05:45:02 GMT

We're able to get to the internet, but everyone has noticed a lag in response times so I decided to check the firewall. Not sure if this is a major issue, but it is an error that I had not seen before. Any ideas of what I can check?

Thanks,

Andrew

this under some

Pranay Prasoon — Thu, 09 Apr 2015 00:05:26 GMT

this under some circumstances can be bug. But they usually not interrupt traffic.

I would suggest looking for how many PAT is already existed with this IP address. You can check "show xlate | in <pat ip address>" and see if the PAT ports are already exhausted. This usually happens because all users are using on one IP for PAT and connection is so high that all the ports got exhausted.

there are some questions through

1) are you using ASA in cluster mode?

2) what is the software version?

3) attach your running-config

Hi,Output of "show nat pool"

Vibhor Amrodia — Fri, 10 Apr 2015 02:56:08 GMT

Hi,

Output of "show nat pool" output would also be helpful in addition to your relevant NAT and ACL configuration.

Thanks and Regards,

Vibhor Amrodia

1) Not in cluster mode2)

andrewdours — Mon, 20 Apr 2015 12:45:00 GMT

1) Not in cluster mode

2) Cisco Adaptive Security Appliance Software Version 9.0(4)
Device Manager Version 7.1(6)

3) I'm not comfortable posting my running configuration. I can just open a case if this is not enough information to go on.

Thanks,

Andrew

Result of the command: "show

andrewdours — Mon, 20 Apr 2015 12:49:54 GMT

Result of the command: "show nat pool"

UDP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 1-511, allocated 1
UDP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 512-1023, allocated 0
UDP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 1024-65535, allocated 113
TCP PAT pool outside, address x.x.x.129, range 1-511, allocated 1
TCP PAT pool outside, address x.x.x.129, range 512-1023, allocated 0
TCP PAT pool outside, address x.x.x.129, range 1024-65535, allocated 0
TCP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 1-511, allocated 0
TCP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 512-1023, allocated 0
TCP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 1024-65535, allocated 670
UDP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 1-511, allocated 0
UDP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 512-1023, allocated 0
UDP PAT pool outside:HOST-x.x.x.113, address x.x.x.113, range 1024-65535, allocated 29
UDP PAT pool outside, address x.x.x.98, range 1-511, allocated 4
UDP PAT pool outside, address x.x.x.98, range 512-1023, allocated 0
UDP PAT pool outside, address x.x.x.98, range 1024-65535, allocated 7
TCP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 1-511, allocated 0
TCP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 512-1023, allocated 0
TCP PAT pool outside:HOST-x.x.x.114, address x.x.x.114, range 1024-65535, allocated 405
TCP PAT pool inside, address 10.255.98.109, range 1-511, allocated 2
TCP PAT pool inside, address 10.255.98.109, range 512-1023, allocated 0
TCP PAT pool inside, address 10.255.98.109, range 1024-65535, allocated 0
UDP PAT pool inside, address 10.255.98.109, range 1-511, allocated 3
UDP PAT pool inside, address 10.255.98.109, range 512-1023, allocated 1
UDP PAT pool inside, address 10.255.98.109, range 1024-65535, allocated 6
TCP PAT pool management, address 10.255.0.110, range 1-511, allocated 2
TCP PAT pool management, address 10.255.0.110, range 512-1023, allocated 0
TCP PAT pool management, address 10.255.0.110, range 1024-65535, allocated 0
UDP PAT pool management, address 10.255.0.110, range 1-511, allocated 1
UDP PAT pool management, address 10.255.0.110, range 512-1023, allocated 1
UDP PAT pool management, address 10.255.0.110, range 1024-65535, allocated 3
TCP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 1-511, allocated 0
TCP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 512-1023, allocated 0
TCP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 1024-65535, allocated 246
UDP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 1-511, allocated 1
UDP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 512-1023, allocated 0
UDP PAT pool any:HOST-x.x.x.113, address x.x.x.113, range 1024-65535, allocated 22

Looking at PAT pool stats,

Pranay Prasoon — Mon, 20 Apr 2015 16:28:52 GMT

Looking at PAT pool stats, this doesn't seem to be exhausted at any point. Opening a TAC case will be better option to dig deeper.

I ended up being more

andrewdours — Thu, 20 Aug 2015 13:54:52 GMT

I ended up being more specific with the NAT statements. Instead of having any - outside I changed many statements to <interface> - outside. That seemed to clear it up.