ASA error in ver 7.0(7)

[jia]

Hello,everybody

         %ASA-3-305005: No translation group found for tcp src inside:211.155.169.186/1433 dst outside:42.121.87.89/6000,    I found this error ,but the IP

211.155.169.186 is public address. I check the configuration but didn't find any information about this address.I don't understand why src is inside? How can I solve this error?

Thank you

ASA version:7.0(7)

[Julio Carvajal]

Hello,

You might have NAT-control enabled and as you know for a packet to traverse the ASA a NAT rule must exist.

Now as you point you do not have the 211.x.x.x subnet on your inside so you should not be doing any nat for that (That is why we are getting those logs)

The question here is who is using that IP and the most important how the heck he is on the internal subnet>???

Ip spoofing, a back-door.

Dude check your internal network desing, make sure there is only one way to go to the internet ( I have worked a lot on cases where the customer says the ASA is the only way out, and trust me there is always a secondary device..So Check your network and after you do it, check it twice)

Any other question.. sure... Just let me know. but remember to rate all of my answers.

Julio