ASA %ASA-3-210007: LU allocate xlate failed

Question

I have a client that keeps receiving the following syslog error:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
ASA %ASA-3-210007: LU allocate xlate failed
It has been identified in bug report:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
CSCsi65122 (http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCsi65122)
This bug report states the following:
/* Style Definitions */
table.MsoNormalTable
{mso-style-name:"Table Normal";
mso-tstyle-rowband-size:0;
mso-tstyle-colband-size:0;
mso-style-noshow:yes;
mso-style-priority:99;
mso-style-parent:"";
mso-padding-alt:0in 5.4pt 0in 5.4pt;
mso-para-margin:0in;
mso-para-margin-bottom:.0001pt;
mso-pagination:widow-orphan;
font-size:10.0pt;
font-family:"Times New Roman","serif";}
Overlapping static with NAT exemption causes xlate errors on standby
Symptom:
"%ASA-3-210007: LU allocate xlate failed" appearing on standby unit
Conditions:
- Stateful failover enabled.
- Overlap between a static NAT rule and the NAT exemption.
-the "alias" command is used to rewrite destination ip address
Workaround:
in the nat exemption access-list deny specifically the traffic matching the source of the traffic with destination the alias'd ip address.
I looked at this bug report and it says the error was first found in 7.0/7.2.  However, the client is running 8.4(1) on the ASA's.  When this problem initially came to light, my co-worker found this bug report:
CSCth74844
http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCth74844&from=summary
This made sense since at the time they were running 8.32 and upgrading to a newer code seemed to be how to fix it according to this article:
http://www.techbloc.net/archives/31
However, even after the upgrade to 8.4(1), the problem still exists.  Do we need to roll them back to the unreleased code that the above article mentions?  Or should this problem have been fixed in the 8.4(1) release?
TIA for any ideas/suggestions.  A call to TAC may be in order for this problem, especially since the workaround doesn't seem to be the best solution.

Answer 1

Deyster,
To troubleshoot this issue, we first need to verify whether thios error message is cosmetic or are we really hitting into any known issue, to identify it, we need to fisrt verify whether the xlate tables on both the firewalls is approximate;y same or not.(you can do this by using show xlate commandf on the firewalls). If it is same  and still we are getting these messages, then it is a cvosmetic issue(which does not affect the traffic).
This particukar message appears if the xlate tables are not correctly replicated between the active and standby unit in failover.
I would request you to provide the below debugs:
debug nat 5
debug fover fail
This would further help is in identifying the issue.
Hope this helps.
Thanks,
Varun