topic Re: portmap translation creation failed in Network Security

portmap translation creation failed

jlmickens — Tue, 12 Mar 2019 00:53:17 GMT

After adding a NAT rule on Friday morning, I'm now getting a bunch of "portmap translation creation failed" messages from my ASA 5520. (It's currently running 8.4(3).) The failure errors appear to have nothing to do with the change that was made. Here are the relevant additions to the config:

! Define objects involved

object network BCSNovar

host 172.16.173.191

object network Harris

! public addresses masked to protect the innocent.

range x.x.x.1 x.x.x.254

description Harris Corporation - Novar

! Access list to allow the traffic in

access-list outside_access_in remark Harris RDP access to BCSNovar server via port 3392

access-list outside_access_in extended permit tcp object Harris object BCSNovar eq 3392 log alerts

! NAT the inside address to the outside address for the port

object network BCSNovar

nat (Inside,Outside) static interface service tcp 3389 3392

I have very similar rules in place for other vendors to access other machines. The only difference between this new one and those old ones is the use of the objects in the rule instead of the direct IP addresses. This is also the first one that invovles a range instead of a specific address or network.

The errors are fairly frequent and usually involved normal web traffic on ports 80/443 or NTP. Here are a few copied from the ASDM interface:

Jan 28 2013

11:26:42

72.240.1.140

123

portmap translation creation failed for udp src Inside:172.16.171.10/65535 dst Outside:72.240.1.140/123

Jan 28 2013

11:27:44

174.132.200.187

portmap translation creation failed for tcp src Inside:172.16.31.119/53767 dst Outside:174.132.200.187/80

Jan 28 2013

11:29:47

74.63.137.149

portmap translation creation failed for tcp src Inside:172.16.30.130/3151 dst Outside:74.63.137.149/80

I have no idea why these are failing. Any help would be appreciated.

portmap translation creation failed

Jennifer Halim — Tue, 29 Jan 2013 01:49:52 GMT

Sounds to me like there is a co-incidence between the newly configured rules and the error message seen.

Did you perform "clear xlate" after configuring the new rules?

Also the IP Address in the error message as you said, doesn't seem to match the newly configured NAT host, so it might not be related.

Without looking at the full configuration, it would be difficult to see what could be the issue.

Re: portmap translation creation failed

jlmickens — Wed, 30 Jan 2013 15:16:47 GMT

I did not do a "clear xlate" after configuring the new rules. Should I have? Do you think doing one now would help?

I've attached the full config.

Re: portmap translation creation failed

Jennifer Halim — Thu, 31 Jan 2013 03:14:13 GMT

Are you still getting the error message, or the error message has disappeared now?

Also, are you actually having any problem from those host in the error message?

If you run packet tracer for the same source and destination as the error message, does it fail or pass? if it fails, can you pls post the output of the packet tracer.

Re: portmap translation creation failed

jlmickens — Thu, 31 Jan 2013 14:56:22 GMT

I am still getting them. Here are a couple of random failures and the associated packet tracer output:

Jan 31 2013 09:32:41: %ASA-3-305006: portmap translation creation failed for udp src Inside:172.16.171.10 (fwdcvod01.buckeyehq.com) /65535 dst Outside:72.240.1.140 (unresolved) /123

Jan 31 2013 09:44:12: %ASA-3-305006: portmap translation creation failed for tcp src Inside:172.16.30.66 (hpc14520rr.buckeyehq.com) /1242 dst Outside:206.72.206.242 (unresolved) /80

Both seem to be dropping at the same rule, which is not one that I altered.

Re: portmap translation creation failed

jlmickens — Tue, 22 Oct 2013 11:24:43 GMT

Ultimately, it was a 'clear xlate' that fixed the issue.