Portmap translation creation failed for udp src inside dst inside

Question

Hi!
I have a problem with allowing traffic to UC500 subnets on ASA 5505 inside interface.
My asa is a main router with addres 192.168.1.1
UC500 voip box is connected to ASA's inside interface through UC500 WAN port with UC500 with 192.168.1.2 address.
Firewall and NAT on UC500 is disable
UC500 sip traffic works fine. voipbox creates its subnets for data and voip - 192.168.10.0 and 10.1.1.0. another important address is 10.1.10.1 which is UC500 CUE.
My problem is that from within ASA local network (192.168.1.0) i cannot reach UC500 subnets, neither can I reach ASA's local network from the UC subnets.
the log says
3
Sep 07 2013
00:21:49
DC
53
PBXCUE
32901
portmap translation creation failed for udp src inside:DC/53 dst inside:PBXCUE/32901
I tried exempting uc500 subnets on ASA but that didn;t work.
Funny thing is that I CAN reach the UC500 subnets when connecting with VPN to ASA...
Please help! I am not familiar with CLI.
I configured static route to 10.1.10.0 and since then I was able to ping 10.1.10.1 thorugh ASA;s VPN.
I would be grateful for ideas.
Lukasz
global (inside) 1 interface
global (outside) 101 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 101 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface https IIS https netmask 255.255.255.255  dns tcp 200 200 udp 200
static (inside,outside) tcp interface www IIS www netmask 255.255.255.255  dns tcp 200 200 udp 200
static (inside,outside) tcp interface smtp IIS smtp netmask 255.255.255.255  dns
static (inside,outside) tcp interface pop3 IIS pop3 netmask 255.255.255.255  dns
static (inside,outside) udp interface domain RenBetPBX domain netmask 255.255.255.255  dns
static (inside,outside) udp interface 5061 RenBetPBX 5061 netmask 255.255.255.255  dns
static (inside,outside) udp interface sip RenBetPBX sip netmask 255.255.255.255  dns
static (inside,outside) tcp interface 13000 SQL 13000 netmask 255.255.255.255  dns
access-group inside_access_in in interface inside
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x
route inside PBXCUE-network 255.255.255.0 RenBetPBX 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy

Answer 1

Hello Julio!
Thank you for your advice.
I have managed to solve my main problem by reconfiguring my switches vlans - enabling trunk port configs for required ports and allowing them access to both vlans.
Now I can see everything from all of my inside networks.
I continue my ASA adventures - I have managed to configure L2TP client access for my windows users, RADIUS authentication for domain users and yesterday night I have managed to configure site to site VPN with my RV120W router.
I am only an enthusiast but my recent successes have given me apetite for more...
I keep reading forums and trying to solve most of my problems myself but I have faced another one now and thought that maybe you could give me another tip on where to look for the issue:
I still have one problem with my L2TP VPN config - I have configured split tunnel on the group policy to tunnel only 192.168.1.0 network requests.
access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
My network at home is 192.168.2.0 but it still tunnels everything (when I check my ip after connecting to VPN my home laptop still identifies with ASA gateway(!) address .
access-list outside_access_in extended permit icmp any interface outside object-group DM_INLINE_ICMP_1
access-list outside_access_in extended permit tcp any interface outside object-group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any interface outside eq smtp
access-list outside_access_in extended permit tcp any interface outside eq 8080
access-list outside_access_in extended permit tcp any interface outside eq 23456
access-list outside_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group DM_INLINE_NETWORK_1 any
access-list outside_access_in extended permit tcp any interface outside eq 13000
access-list outside_access_in extended permit tcp any interface outside range 8001 8016
access-list outside_access_in extended permit tcp x.x.x.x 255.255.255.0 interface outside eq ssh
access-list inside_nat0_outbound extended permit ip any 192.168.1.240 255.255.255.240
access-list inside_nat0_outbound extended permit ip any PBXVOIP-network 255.255.255.0
access-list inside_nat0_outbound extended permit ip any PBXCUE-network 255.255.255.0
access-list inside_nat0_outbound extended permit ip 192.168.1.0 255.255.255.0 igolomska-network 255.255.255.0
access-list inside_access_in extended permit udp object-group DM_INLINE_NETWORK_2 any object-group DM_INLINE_UDP_1
access-list inside_access_in extended permit ip host IIS any
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit ip host RBSTORE_NAS any
access-list inside_access_in extended deny udp any any object-group DM_INLINE_UDP_2
access-list inside_access_in extended permit tcp any any eq 5432
access-list inside_access_in extended permit tcp any host PBXCUE eq www
access-list inside_access_in extended permit tcp host PBXCUE any eq www
access-list inside_access_in extended permit tcp host RBCAMSTORE_NAS host EXCH-MBX eq smtp
access-list inside_access_in extended permit tcp host RBSTORE_NAS host EXCH-MBX eq smtp
access-list inside_access_in extended permit tcp host RENBETUPS host EXCH-MBX eq smtp
access-list inside_access_in extended permit tcp host RenBetPBX host EXCH-MBX eq smtp
access-list DefaultRAGroup_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list outside_1_cryptomap extended permit ip 192.168.1.0 255.255.255.0 igolomska-network 255.255.255.0
route print shows:
and 192.168.1.240 is my VPN IP - its metric has higher priority than the local gateway.
How do I change it?
Active Routes:
Network Destination        Netmask          Gateway       Interface  Metric
          0.0.0.0          0.0.0.0      192.168.2.1    192.168.2.126   4250
          0.0.0.0          0.0.0.0         On-link     192.168.1.240     21
      80.51.24.22  255.255.255.255      192.168.2.1    192.168.2.126   4251
        127.0.0.0        255.0.0.0         On-link         127.0.0.1   4531
        127.0.0.1  255.255.255.255         On-link         127.0.0.1   4531
  127.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
      169.254.0.0      255.255.0.0         On-link     192.168.2.126   4506
  169.254.104.126  255.255.255.255         On-link     192.168.2.126   4506
  169.254.255.255  255.255.255.255         On-link     192.168.2.126   4506
    192.168.1.240  255.255.255.255         On-link     192.168.1.240    276
      192.168.2.0    255.255.255.0         On-link     192.168.2.126   4506
    192.168.2.126  255.255.255.255         On-link     192.168.2.126   4506
    192.168.2.255  255.255.255.255         On-link     192.168.2.126   4506
        224.0.0.0        240.0.0.0         On-link         127.0.0.1   4531
        224.0.0.0        240.0.0.0         On-link     192.168.2.126   4506
        224.0.0.0        240.0.0.0         On-link     192.168.1.240     21
  255.255.255.255  255.255.255.255         On-link         127.0.0.1   4531
  255.255.255.255  255.255.255.255         On-link     192.168.2.126   4506
  255.255.255.255  255.255.255.255         On-link     192.168.1.240    276
===========================================================================
I am starting to feel like I am using a bit too much of your friendliness ...
Best Regards and have a great day!
Lukasz