FWSM-3-305005 message flood from standby FWSM

jstewart · ‎09-09-2004

My Secondary - Standby FWSM is producing 300K+ error messages a day like the following:

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/4569 dst outside:0.0.0.0/0

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/4825 dst outside:0.0.0.0/0

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/5081 dst outside:0.0.0.0/0

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/5337 dst outside:0.0.0.0/0

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/5593 dst outside:0.0.0.0/0

Sep 09 2004 14:57:04: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/5849 dst outside:0.0.0.0/0

or

Sep 09 2004 15:26:47: %FWSM-3-305005: No translation group found for tcp src inside:x.xxx.69.12/1153 dst outside:0.0.0.0/0

Sep 09 2004 15:26:47: %FWSM-3-305005: No translation group found for protocol 0 src inside:x.xxx.69.12 dst outside:0.0.0.0

Sep 09 2004 15:26:47: %FWSM-3-305005: No translation group found for udp src inside:x.xxx.69.12/1153 dst outside:0.0.0.0/0

Sep 09 2004 15:26:47: %FWSM-3-305005: No translation group found for icmp src inside:x.xxx.69.12 dst outside:0.0.0.0 (type 0, code

0)

The x.xxx.69.12 is a real machine on the inside which communicates successfully, mostly with sun rpc, with machines behind the outside interface.

The Primary - Active FWSM produces no such error messages. I am running 2.2.1.11.

I can't figure out why the Standby FWSM is producing error messages at all. Any ideas where to start looking?

nkhawaja · ‎09-11-2004

Are both the FWSMs in different switches? What sort of trunk you have between those switches? What bandwidth? probably the xlates are not replcating to the secondary fwsm. What if you failover to secondary, would you still get the messages on primary (standby) then.

jstewart · ‎09-13-2004

Yes, they are on different switches. I have a 3 x 1GB trunk/channel between them dedicated to the 'failover' and 'stateful' vlans. When I failover to the secondary, I get the messages from the new standby.