topic Re: Portmap translation Creation failed in Network Security

Portmap translation Creation failed

avburren1 — Mon, 11 Mar 2019 19:47:44 GMT

Hi,

I'm using ASA5510 and I have a problem with the LAN since I install the ASA instead an old sonicwall :

I have 2 network in the LAN :

IP : 192.168.1.0/24
Gateway : 192.168.1.254 ( ASA LAN interface)

192.168.2.0/24
Gateway : 192.168.2.1 ( Router interface)

I don't join network 2.0 from 1.0, I have this log message : " Portmap translation Creation failed - event syslog : 305006 "

Any ideas ?

Thanks

Re: Portmap translation Creation failed

Jennifer Halim — Wed, 09 Feb 2011 10:36:05 GMT

Sorry, don't quite understand what you are trying to achieve.

Where is the router connected to in relation to the ASA? Where does subnet of 192.168.2.0/24 connect to on the ASA?

Can you please share the topology diagram as well as a current configuration from the ASA, and lastly are you trying to connect between the 2 subnets?

Re: Portmap translation Creation failed

avburren1 — Wed, 09 Feb 2011 13:53:32 GMT

I join a topology diagram and logs with the message "portmap creation ...."

I try to ping between 192.168.1.111 (monitoring server) for example, and 192.168.2.116 but it doesn't work since I change the Firewall by the ASA.

Hope it will be more clear.

Re: Portmap translation Creation failed

Kureli Sankar — Thu, 10 Feb 2011 00:26:09 GMT

Both the source and destination are in the LAN segment. Make sure that the source and destination point to the

router as their GW and not the ASA as their GW.

Once done, it should work.

-KS

Re: Portmap translation Creation failed

avburren1 — Thu, 10 Feb 2011 14:59:44 GMT

Here is the configuration that works with the old FW :

192.168.1.111 use the FW LAN interface as Gateway.
192.168.2.116 use 192.168.2.1 (one of the router Interface) as Gateway.

And Route on the FW :
192.168.2.0 192.1688.1.230 255.255.255.0 LAN 1

I don't understand why it doesn't work with the ASA because I haven't changed IP's.
Thanks.

Re: Portmap translation Creation failed

avburren1 — Fri, 11 Feb 2011 09:00:37 GMT

ok, I found a part of the solution :

I use actually :

global (WAN) 1 interface
nat (LAN) 1 192.168.1.0 255.255.255.0

So I add an exempt rule :
source: 192.168.1.0/24
destination : 192.168.2.0/24

Now I ping from 192.168.1.111 to 192.168.2.116 but the reverse doesn't work.

Ping from 192.168.2.116 to 192.168.1.111 display this logs :

"denied ICMP type=0 from laddres 192.168.1.116 on interface LAN to 192.168.2.116: no matching session"

Thank you

Re: Portmap translation Creation failed

Jennifer Halim — Fri, 11 Feb 2011 09:51:52 GMT

You will have to create access-list and apply that to your WAN interface to allow ping from the WAN subnet towards the LAN subnet:

access-list outside-acl permit icmp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-group outside-acl in interface WAN