asked on

Strange Syslog Behavior

I have asked 3 CCIE level networking people and none have given me a good explination for the behavior. The syslog is below. The situation is that all of a sudden an IP address seems to pop out of another interface with no good explinations. The ASA's are the same on all the VLANS. There are no redundancies on the ARP tables for that IP address. For some reason there is just a denied ICMP addresses out of the karen interface. If someone can create a solid explination for me that makes sense and you know is true, the points are yours. If I can raise the points, I would do so as I know it is a tough question.

12/23/2005 10:13      Syslog.Warning      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-4-106023: Deny icmp src bob:192.168.30.25 dst chomp:192.168.90.140 (type 3, code 3) by access-group "bob_access_in"
12/23/2005 10:13      Syslog.Info      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-6-302013: Built outbound TCP connection 219053611 for faddr 192.168.30.25/3994 gaddr 192.168.90.140/51559 laddr 192.168.90.140/51559
12/23/2005 10:13      Syslog.Info      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-6-302014: Teardown TCP connection 219053611 faddr 192.168.30.25/3994 gaddr 192.168.90.140/51559 laddr 192.168.90.140/51559 duration 0:00:00 bytes 76 (TCP Reset-O)
12/23/2005 10:13      Syslog.Warning      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-4-313004: Denied ICMP type=3, from laddr 192.168.30.25 on interface karen to 192.168.90.140: no matching session
12/23/2005 10:13      Syslog.Warning      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-4-106023: Deny icmp src bob:192.168.30.25 dst chomp:192.168.90.140 (type 3, code 3) by access-group "bob_access_in"
12/23/2005 10:13      Syslog.Warning      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-4-106023: Deny icmp src bob:192.168.30.25 dst chomp:192.168.90.140 (type 3, code 3) by access-group "bob_access_in"
12/23/2005 10:13      Syslog.Info      192.168.50.1      Dec 23 2005 10:13:24: %FWSM-6-302013: Built outbound TCP connection 219053613 for faddr 192.168.30.25/44333 gaddr 192.168.90.140/55855 laddr 192.168.90.140/55855

SOLUTION

Les Moore

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

wefixpc4u

I experienced something somewhat similar to this before with a malformed e-mail body. Person Local-A opens an e-mail from Person External-X. In our case there was inline HTML with the URL http://172.16.11.12/somecrap, which Outlook Express tried to open. Since we were on a 172.16.1.XXX with a 255.255.0.0 mask, the first thing the network tried was to find the host locally. Since the host was not found, and the gaddr 172.16.XXX.XXX is dropped outside the network, the inline HTML failed to show up, and that was the end of that. But it generated similar (not identical) messages in our PIX. It took a few days of casual looking through logs to figure out what was going on. However, in our case there were ARPs that showed up, and you are saying that there are no ARP cache entries for this IP, which I find odd. I don't know that this is your problem, but it is probably something completely innocuous that is not really hurting anything and not generating any real logjams on the network (although it is obviously getting under your skin - as it would mine).

Perhaps this experience might lead you closer to resolving your problem.

Good luck!

SOLUTION

jdavi18

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

ASKER CERTIFIED SOLUTION

Frabble

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

Venyu

I have a Cisco firewall that is logging the following SYSLOG (about 15 per second):

Denied ICMP type=3, from laddr 10.1.72.30 on interface Inside539 to 67.128.185.202: no matching session

The destination IP of 67.128.185.202 varies, but the source is always the same. I have found that the customer has SolarWinds installed on this host. Why would the firewall be blocking OUTBOUND packets when I have an outbound ACL (applied to Inside539 interface)?

access-list Inside539_access_in extended permit ip 10.1.27.0 255.255.255.0 any

Les Moore

Venyu, you have to post a new question.