ASA Syslog - No Translation Group Found

[Robert Juric]

I recently noticed I'm getting flooded with these messages saying No Translation Group Found for an inside to an inside IP address. I'm not sure what could be causing this. Below is my NAT configuration:

global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
nat (outside) 1 10.60.2.0 255.255.255.0
nat (outside) 2 10.103.13.0 255.255.255.0

Any suggestions on where to look?

[mirober2]

Hi Robert,

The syslogs indicate that the packet is destined to a host on your inside interface and sourced from a host on the same interface? Does this seem like legitimate traffic or a spoofing/routing issue? If the traffic seems legitimate, you'll need to setup the ASA to allow traffic to be u-turned on the inside interface:

same-security-traffic permit intra-interface

static (inside,inside) netmask

Otherwise, I would suggest investigating why these packets are in the network. Packet captures on the inside interface would be a good starting place to help you trace the packet back through the network via MAC address.

Hope that helps.

-Mike

[Robert Juric]

One address is my NMS, the other is a remote location via S2S VPN tunnel. I'm not sure if that qualifies as inside to inside.

[mirober2]

Hi Robert,

In that case, make sure you have an entry in your NAT 0 ACL (nonat) for this traffic. That will prevent NAT from taking place and the packet should be sent over the tunnel.

-Mike

[Robert Juric]

There is an entry in my nonat ACL for this subnet. I did some further research and found out that this alert is being generated by

my printer server trying to communicate with a printer on the remote end of the S2S VPN tunnel. The tunnel is currently

down at the moment as well. Could the fact that the ASA doesn't know where to send the traffic be causing this error?

Also, is there any way to correct this issue (other than bringing the VPN tunnel up)? Or should I possibly adjust my logging level?

Thanks for the help everyone,

Robert

[lcuevas1]

when you configure a Site to Site VPN there is a NO-NAT rule between both subnets, source and destination, yes or no?

[lcuevas1]

Hi Robert, you cant apply a NAT from the inside to the inside, i think.