pix sys log message

[nataraj_v]

Dear all ,

im getting this message repeatedly..in my pix syslog

2005-02-28 15:05:12 Local4.Error 172.16.1.39 Feb 28 2005 02:29:01: %PIX-3-305005: No translation group found for tcp src dmz1:10.64.1.34/51159 dst outside:10.0.67.102/8080

since one month im getting this message.. but everything is fine.. so far.. no problem yet. i referred cisco pix syslog message documentation. as per it it could be internal error. r configuration error.

but for my knowledge everything running well

can any body through on this ..

thnnx in advance

nataraj

[fedrodri]

Hi, Nataraj

As the Syslog Message documentation said, that is whether an internal error (very unlike to happen) or a configuration error (most likely to happen). So, it seems that there is traffic coming from the dmz1 interface destined to 10.0.67.102 (or let's just assume 10.0.67.0/24). The PIX could not find an specific route to 10.0.67.0/24, so it tries to send it through the outside interface, where the default gateway is (most probably). Then, it looks for translation rules for the source IP/network (assuming 10.64.1.0/24). It does not find anything and logs the syslog message.

So, what I would do is to make sure that this is valid traffic, first of all, and then look at the configuration and make sure that you have setup the correct translation rule from the source in the dmz1(10.64.1.0/24) to the outside (destination 10.0.67.0/24).

If you could post your config, I'll take a look at it and let you know what I think or see there.

Best regards,

Federico Rodriguez

[nataraj_v]

Dear Federic,

Iam attaching my configuration here..

Pls look into this.

thnx in advance

nataraj

[fedrodri]

Hi, Nataraj

As I suspected, the PIX syslog message is indeed a valid message. The PIX is detecting traffic coming from a host on the DMZ1 interface, with a source IP address 10.64.1.34, and destined to 10.0.67.102 (on TCP port 8080).

So, looking at the configuration, I don't see a translation rule for anything on the 10.64.1.0/24 (or, 10.64.1.32/27) network, or for 10.64.1.34, on the DMZ1 interface; this translation rules could be something like an "static (dmz1,outside) x.x.x.x 10.64.1.34", or "static (dmz1,outside) x.x.x.32 10.64.1.32 netmask 255.255.255.224", or "nat (dmz1) 3 10.64.1.32 255.255.255.224 and global (outside) 3 interface", or anything like that...

But, seems like source IP address reported coming from the DMZ1 is an IP that belongs to the outside interface subnet (10.64.1.32/27)!!! Please check on that! Perhaps you have both dmz1 and outside on the same switch but did not configured any vlans on it (?). The message is very clear on that: the source is 10.64.1.34 and it came on the dmz1 interface. Please check for any misconfigured host on the dmz1 interface or the fact that you might have two subnets "melt" on the same switch without having vlans on it... Let us know...

Best regards,

Federico.