Solved

ASA syslog error 305005

Posted on 2013-01-01
14
747 Views
Last Modified: 2013-01-06
I'm always getting this syslog message (305005), I tried to do the NAT exempt feature, and I'm still getting the same error syslog message. I don't want to translate some IPs, because I don't want to give them Internet access. Is there any work around to avoid this syslog messages from appearing continuously.
0
Comment
Question by:omar07
  • 5
  • 4
  • 4
  • +1
14 Comments
 
LVL 13

Expert Comment

by:Sandy
ID: 38735730
This message indicates a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the ACL bound to the NAT 0 ACL.
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38735820
Well, in this case it isn't a configuration error because you don't want some IP's to be translated.
What you could do is:
-just keep the message from appearing by using:  no logging message 305005
-adjust the NAT statement so only the IP range that is allowed to access internet is in there.
0
 
LVL 1

Expert Comment

by:thpipfh
ID: 38735932
Hello,

For error 305005:  This message indicates a configuration error. If dynamic NAT is desired for the source host, ensure that the nat command matches the source IP address. If static NAT is desired for the source host, ensure that the local IP address of the static command matches. If no NAT is desired for the source host, check the ACL bound to the NAT 0 ACL.

and Study about NAT and ACL's with below urls:

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/acl_overview.html

http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/nat_overview.html
0
MIM Survival Guide for Service Desk Managers

Major incidents can send mastered service desk processes into disorder. Systems and tools produce the data needed to resolve these incidents, but your challenge is getting that information to the right people fast. Check out the Survival Guide and begin bringing order to chaos.

 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38735940
I took the liberty of adding the PIX/ASA topic to your question to draw some extra attention.
0
 
LVL 1

Expert Comment

by:thpipfh
ID: 38735949
Please refer below link for ASA sys log errors

http://www.cisco.com/en/US/docs/security/asa/asa71/system/message/logmsgs.html#wp1280900

Good Luck
0
 

Author Comment

by:omar07
ID: 38736273
Erniebeek,
I tried to do NAT 0 with ACL for the IP addresses that do not require translation, but I still get the same log messages.
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38736312
Could you give us some more info?
For starters, a sanitized copy of your configuration would help a lot :)
0
 

Author Comment

by:omar07
ID: 38737172
Erniebeek,

I used NAt exempt just to prevent the syslog message from popping up every now and then, something like:

      access-list inside_nat0_outbound line 1 extended permit ip 192.168.1.1 255.255.255.255     209.165.32.1 255.255.255.255
      nat (inside) 0 access-list inside_nat0_outbound  tcp 0 0 udp 0

I used the code above, and I'm still getting the error 305005
0
 
LVL 1

Expert Comment

by:thpipfh
ID: 38739149
Please verify security levels and NAT rules and try with

 nat (outside) 0 access-list inside_nat0_outbound  tcp 0 0 udp 0
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 500 total points
ID: 38739339
Well if you just want to prevent the message from popping up, use the no logging message 305005 like I stated above.

When using NAT exempt, the machines are still allowed through the ASA, only they're not NATted. I assume the nat0 range you defined is a subset of the NATted range (?) That can give some strange results.
I would say: get rid of that nat exempt and block the addresses you don't want to pass through by using an ACL on the inside interface (and/or use the no logging commande).
0
 

Author Comment

by:omar07
ID: 38739655
Ok. and how can I use ACL to block the addresses that I don't want to translate.
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 38739694
Something like:

access-list inside deny ip host 192.168.1.10 any (Deny one address)
access-list inside deny ip 192.168.1.0 255.255.255.240 any (or deny a range)
access-list inside permit ip any any (then permit the rest)

access-group inside in interface inside if your inside interface is named 'inside' :)

So you first block everything you don't want to go through and then allow everything (because an ACL is processed top-down).
0
 
LVL 1

Expert Comment

by:thpipfh
ID: 38739711
please give me your runing configuration.... for better understanding.
0
 

Author Comment

by:omar07
ID: 38746366
The no logging command works fine, but the ACL is denying everything not natting only. How can deny the range I want from nat only.
0

Featured Post

Create the perfect environment for any meeting

You might have a modern environment with all sorts of high-tech equipment, but what makes it worthwhile is how you seamlessly bring together the presentation with audio, video and lighting. The ATEN Control System provides integrated control and system automation.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Manage ASA using outside IP 14 63
creating SVI on layer 3 switch 1 28
cisco asa proxy arp 2 18
Changing VLAN information 3 16
Outsource Your Fax Infrastructure to the Cloud (And come out looking like an IT Hero!) Relative to the many demands on today’s IT teams, spending capital, time and resources to maintain physical fax servers and infrastructure is not a high priority.
Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

821 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question