XLATE ?!

[iiiiss]

HI

Sorry this may sound a bit stupid but what does the error message : "Deny .... (No xlate)..." mean and whats more important ....... what can I do to solve this problem ?
Is this a routing issue ??

Thanks for the help

 

[iiiiss]

Hi again !

Please can anyone explain to me what "no translation group found" means ? I think this has something to do with the "no xlate" message ..

Best regards

 

[khaledeshah]

Hi

Explanation|: This message logs when a nat and global command cannot be found for a protocol, The protocol can be TCP, UDP, or ICMP.
Action : This message can be either an internal error or an error in the configuration.

 

[iiiiss]

Thanks but I read the Cisco Page too *G*.... doesn´t really help me much but thanks for the response

 

[khaledeshah]

Hi
Can u send us ur config file to see what is wrong

 

[iiiiss]

Thanks for the help . Here are more specific informations :

I just want to ping from dmz to a network on the inside interface (access-lists are correct).

dmz workstation x.x.x.2 dmz interface x.x.x.1

inside interface x.x.166.2 router on the inside interface has x.x.166.1

server to ping has x.x.166.8

I can ping from the server to the dmz server but not visa versa .
--------------------
route inside x.x.165.160 x.x.x.x x.x.166.1 1
--------------------

I would like to set a default route for the inside interface but that seems to be impossible is that right ?

Do I need any other route entries ???

Thanks for the help

 

[iiiiss]

Ok I think I figured it out myselfe... I just have to use
a static command ...

Thanks for the help.

Best regards

 

[gbiello]

Was the static command something like this?
"static (inside,dmz) 192.168.0.0 192.168.0.0 netmask 255.255.0.0 0 0"
It seems a bit bizarre, but you do need them.

-gbiello

 

[iiiiss]

Yeah was something .... but the IP addresses weren´t the same on the inside and the dmz because thats not possible but basically you are right.

 

[yizhar]

HI.

Please note that the basic idea of DMZ is that it cannot initiate connections to internal hosts (only to accept connections originated inside).

Using the "static" command might lead to a security breach, and you I would favor the more traditional design - the DMZ server cannot ping the inside.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar