Cisco FWSM Denying Outbound ICMP (type 3)

I have a Cisco firewall that is logging the following SYSLOG (about 15 per second):

Denied ICMP type=3, from laddr 10.1.72.30 on interface Inside539 to 67.128.185.202: no matching session

The destination IP of 67.128.185.202 varies, but the source is always the same.  I have found that the customer has SolarWinds installed on this host.  Why would the firewall be blocking OUTBOUND packets when I have an outbound ACL (applied to Inside539 interface)?

access-list Inside539_access_in extended permit ip 10.1.72.0 255.255.255.0 any
VenyuAsked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
harbor235Connect With a Mentor Commented:


is someone scanning from inside your network outbound? Aah solarwinds, someone is scanning

ICMP type 3 is destination unreachable, do you have a default route outbound, can you route to 67.128.185.202 (try pinging from the same subnet) 15 per second is a pretty good rate.

The firewall will approximate icmp connections, if the icmp message does not have a nmatching component you can get this message, i am not sure how someone generates the type 3 unsolicitated unless they have a packet generator.

Coupls of things, sniff the traffic coming from the suspected port and see ehats coming in and going out

harbor235 ;}
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.