Nothing matches that yet. Tell us what you were looking for and it goes on the list.
Cisco ASA / Firepower Threat Defense · Event 305011
The firewall assigned an internal address and port a public one. This is the message that lets you answer 'which internal machine was 203.0.113.10 port 45392 at 14:07 last Tuesday' — the single question NAT otherwise makes unanswerable.
Also written as %ASA-6-305011ASA 305011Built dynamic TCP translationasa nat translation built
Your router does this constantly and does not usually tell you about it. When many devices share one public address, the firewall has to keep a table mapping each internal conversation to a different port on that shared address. This message records one of those mappings being created.
This is your attribution log, and most sites discover they were not keeping it at the moment an abuse complaint or a law-enforcement request arrives naming a public address, a port, and a timestamp. Without 305011 and 305012 you can identify the firewall and nothing else. Volume is the real constraint: on a busy edge these can outnumber connection events, so decide the retention deliberately rather than by accident.
Sanitised. Addresses come from the RFC 5737 documentation ranges.
Sep 07 2026 14:07:22 fw-edge-01 : %ASA-6-305011: Built dynamic TCP translation from inside:192.0.2.44/51993 to outside:203.0.113.10/45392Everything else in the log line is context.
dynamicAssigned from a pool or by port address translation. Short-lived and only meaningful with the timestamp. staticA fixed one-to-one mapping. Recorded once and then persistent, so far less interesting after the first entry. Most of the time it is one of these.
What gives it awayOne real address holding a disproportionate share of translations over a short window, usually with many distinct mapped ports and few completed connections.
ATT&CK T1046What gives it awayA steep rise in translation creation paired with 305006 translation-creation failures, after which new outbound connections stop working for everyone.
ATT&CK T1499What gives it awaySustained translations from a server or an appliance that normally only receives connections.
ATT&CK T1041grep '305011' asa.log | grep '203.0.113.10/45392'index=firewall "%ASA-6-305011" | rex "from (?<real_if>\w+):(?<real_ip>[\d\.]+)/(?<real_port>\d+) to (?<map_if>\w+):(?<map_ip>[\d\.]+)/(?<map_port>\d+)" | stats count by real_ip | sort - countevent.code:305011 and destination.nat.ip:"203.0.113.10" and destination.nat.port:45392 and @timestamp >= "now-7d"show xlate countBecause it is the only record that maps a public address and port back to an internal machine at a point in time. When an abuse report, a threat intelligence hit, or a legal request arrives quoting your public IP and a port, this is what turns that into an actual host. Without it, NAT has erased the information permanently — you cannot reconstruct it later.
Long enough to cover how late these requests arrive, which in practice is months rather than days. Abuse reports and law-enforcement requests routinely reference activity weeks old. Storage is the trade-off: on a busy edge these messages can exceed connection logs in volume, so many sites keep 305011 and its teardown messages in cheaper long-term storage than the rest of the firewall log.
305011 records the address translation — which internal address and port became which public address and port. 302013 records the connection itself — which endpoints are talking and over what. They fire together for the same traffic, but only 305011 answers the attribution question, and only 302013 gives you the far end of the conversation.
That is hairpinning: an internal host reached another internal host, or itself, by way of a public address, so the traffic left and re-entered on the same interface. It is normal on networks where internal clients use public DNS names for internally hosted services, and it requires 'same-security-traffic permit intra-interface' to work at all.
Last reviewed 7 September 2026