topic Re: portmap translation creation failed for tcp src inside:192.1 in Network Security

portmap translation creation failed for tcp src inside:192.168.91.35/32483 dst dmz4:10.10.7.21/443

Matthew Michaluk — Mon, 11 Mar 2019 21:30:18 GMT

Hello all.

I am having an issue where clients at remote sites can not access website in our dmz. Any thoughts?

Thanks.

portmap translation creation failed for tcp src inside:192.168.9

Jon Marshall — Mon, 26 Sep 2011 21:20:13 GMT

Matthew

Which interface do the clients use to get to the DMZ (looks like the inside interface from your post ?)

Do the clients use VPN or is it just normal traffic ?

Do you have a NAT statement setup for the client traffic to the DMZ ?

Jon

portmap translation creation failed for tcp src inside:192.168.9

Matthew Michaluk — Mon, 26 Sep 2011 21:32:11 GMT

Inside

Normal traffic.

nat (dmz4) 101 0.0.0.0 0.0.0.0

portmap translation creation failed for tcp src inside:192.168.9

Kureli Sankar — Tue, 27 Sep 2011 00:01:02 GMT

Pls. share the output of "sh run nat" and "sh run global"

-KS

portmap translation creation failed for tcp src inside:192.168.9

Matthew Michaluk — Tue, 27 Sep 2011 14:12:11 GMT

sh run nat

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 0.0.0.0 0.0.0.0

nat (dmz4) 101 0.0.0.0 0.0.0.0

nat (dmz3) 101 0.0.0.0 0.0.0.0

sh run global

global (outside) 101 207.40.1.252 netmask 255.255.255.255

portmap translation creation failed for tcp src inside:192.168.9

Matthew Michaluk — Thu, 13 Oct 2011 16:33:29 GMT

Anyone?

portmap translation creation failed for tcp src inside:192.168.9

varrao — Thu, 13 Oct 2011 16:37:06 GMT

You might need to add this:

global (dmz4) 101 interface

There no translation for the inside host when they go the dmz4 interface.

Hope that helps,

Varun

portmap translation creation failed for tcp src inside:192.168.9

fitzerpn1 — Wed, 16 Nov 2011 18:37:48 GMT

I was having the same problem after changing dynamic nat pools around and found the below tip here (at the bottom under troubleshooting). I ran clear xlate and my problem was solved immediately.

Translation Creation Failed

If a connection cannot be created between the client and the WWW server, it might be due to a NAT misconfiguration. Check the security appliance logs for messages which indicate that a protocol failed to create a translation through the security appliance. If such messages appear, verify that NAT has been configured for the desired traffic and that no addresses are incorrect.

%ASA-3-305006: portmap translation creation failed for tcp src 
inside:192.168.100.2/11000 dst inside:192.168.100.10/80

Clear the xlate entries, and then remove and reapply the NAT statements in order to resolve this error.

portmap translation creation failed for tcp src inside:192.168.9

Julio Carvajal — Wed, 16 Nov 2011 18:53:21 GMT

Hello Patrick,

As Varun said you will need to add the following:

global (dmz4) 101 interface

You can do a packet-tracer too see if now we are hitting the correct nat statement when the packet goes from the dmz to the inside (syn-ack).

packet-tracer input inside tcp 192.168.100.2 1025 10.10.7.21 443

You can do a clear local-host 10.10.7.21 and clear xlate local 10.10.7.21

Regards,

Julio

portmap translation creation failed for tcp src inside:192.168.9

smayfield — Wed, 29 Feb 2012 21:15:37 GMT

You need to add an NO NAT from your inside interface to your DMZ to get this to work.

portmap translation creation failed for tcp src inside:192.168.9

smayfield — Wed, 29 Feb 2012 21:20:45 GMT

So for example you have this.

192.168.1.0/24Inside(FW)or (RA VPN) ---------VPN------------(FW )10.1.1.0/24Inside------192.168.10.0/24 DMZ

access-list INSIDE_NO_NAT extended permit ip 192.168.1.0 255.255.255.0 192.168.10.0 255.255.255.0

nat (inside) 0 access-list INSIDE_NO_NAT

Re: portmap translation creation failed for tcp src inside:192.1

John Peterson — Wed, 12 Jun 2013 21:12:09 GMT

Hi Julio,

I today was having the same issue.

Who doing hairpining NAT on a tcp port, to and from the same interface. Why is it that you need global (dmz4) 101 interface?

Thanks

Re: portmap translation creation failed for tcp src inside:192.1

Julio Carvajal — Wed, 12 Jun 2013 23:20:56 GMT

Hello John,

Here is a document that will help u with the U-turn understanding:

https://supportforums.cisco.com/docs/DOC-34107

Let me know if u Understand the reason afterwards