PIX 525 is disallowing new connections

[noc]

I am using PIX 525 running 6.2 to protect inside and dmz networks. I am using static NAT. The PIX is denying outbound connections from dmz as well as inside interfaces though implicit permit is already there. the log messages are:

"201008: The PIX is disallowing new connections.

305006:outbound static translation creation failed for tcp src ................

Please Help to resolve the issue.

[tvanginneken]

Hi,

have a look at this url:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_v51/syslog/pixemsgs.htm#xtocid5

and you will find this info:

%PIX-3-201008: The PIX is disallowing new connections.

Explanation

This message occurs when you have enabled TCP syslogging and the syslog server cannot be reached, or when using PFSS (PIX Firewall Syslog Server) and the disk on the Windows NT system is full.

Action

Disable TCP syslogging. If using PFSS, free up space on the Windows NT system where PFSS resides. Also make sure that the syslog host is up and you can ping the host from the PIX Firewall console. Then restart TCP syslogging to allow traffic.

%PIX-3-305006: type translation creation failed for protocol

Explanation

A protocol (UDP, TCP, or ICMP) failed to create a translation through the PIX Firewall. The type can be static, portmapped (PAT), or regular.

Action

This message can be either an internal error or an error in the configuration.

Kind Regards,

Tom

[noc]

Both the problems have been resolved. Thanks for your help.

Another issue is that I am able to ping from inside to DMZ but not been able to access other services like web/ftp etc. the log shows the following message:

302013:built outbound tcp connection 7 for DMZ

Where I am wrong?

[tvanginneken]

Hi,

is it possible to post:

- the translation commands from the inside to the dmz

- the access-lists applied to the inside interface and the dmz interface

Thanks!

Kind Regards,

Tom

[noc]

nameif ethernet0 outside security0

nameif ethernet1 inside security100

nameif ethernet3 DMZ security60

static (DMZ,outside) 192.168.1.2 192.168.1.2 netmask 255.255.255.255 0 0

static (inside,outside) 192.168.2.2 192.168.2.2 netmask 255.255.255.255 0 0

static (inside, DMZ) 192.168.2.2 192.168.2.2 netmask 255.255.255.255 0 0

access-group outside_access_in in interface outside

access-group DMZ_access_in in interface DMZ

[thong.do]

Check your NAT configuration, might be it is related to subnet mask .

And you should check your logging host or temporary disable forwarding cisco logs to the logging host.

Thong Do