Portmap translation Creation failed

[avburren1]

Hi,

I'm using ASA5510 and I have a problem with the LAN since I install the ASA instead an old sonicwall  :

I have 2 network in the LAN :

IP : 192.168.1.0/24
Gateway : 192.168.1.254 ( ASA LAN interface)

192.168.2.0/24
Gateway : 192.168.2.1 ( Router interface)

I don't join network 2.0 from 1.0, I have this log message :  " Portmap translation Creation failed - event syslog : 305006 "

Any ideas ?

Thanks

[Jennifer Halim]

Sorry, don't quite understand what you are trying to achieve.

Where is the router connected to in relation to the ASA? Where does subnet of 192.168.2.0/24 connect to on the ASA?

Can you please share the topology diagram as well as a current configuration from the ASA, and lastly are you trying to connect between the 2 subnets?

[avburren1]

I join a topology diagram and logs with the message "portmap creation ...."

I try to ping between 192.168.1.111 (monitoring server) for example, and 192.168.2.116 but it doesn't work since I change the Firewall by the ASA.

Hope it will be more clear.

[Kureli Sankar]

Both the source and destination are in the LAN segment. Make sure that the source and destination point to the

router as their GW and not the ASA as their GW.

Once done, it should work.

-KS

[avburren1]

Here is the configuration that works with the old FW :

192.168.1.111 use the FW LAN interface as Gateway.
192.168.2.116 use 192.168.2.1 (one of the router Interface) as Gateway.

And Route on the FW :
192.168.2.0 192.1688.1.230 255.255.255.0 LAN 1

I don't understand why it doesn't work with the ASA because I haven't changed IP's.
Thanks.

[avburren1]

ok, I found a part of the solution :

I use actually :

global (WAN) 1 interface
nat (LAN) 1 192.168.1.0 255.255.255.0

So I add an exempt rule :
source: 192.168.1.0/24
destination : 192.168.2.0/24

Now I ping from 192.168.1.111 to 192.168.2.116 but the reverse doesn't work.

Ping from 192.168.2.116 to 192.168.1.111 display this logs :

"denied ICMP type=0 from laddres 192.168.1.116 on interface LAN to 192.168.2.116: no matching session"

Thank you

[Jennifer Halim]

You will have to create access-list and apply that to your WAN interface to allow ping from the WAN subnet towards the LAN subnet:

access-list outside-acl permit icmp 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-group outside-acl in interface WAN