Solved

ASA-4-313005

Posted on 2013-02-06
25
1,665 Views
Last Modified: 2013-02-11
Hello,
I'm trying to send syslog message from cisco switch 2960 to a syslog server, but there's a firewall sits between the switch and the syslog server. I can ping from hosts connected to the switch to the log server, but I can't ping from the switch itself to the log server, and I get error message 313005, and the ASA dropping the icmp because there's no session established for this connection. What should I do in the firewall, to allow syslog message to be sent to the syslog server.
0
Comment
Question by:omar07
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 10
  • 4
  • 3
  • +3
25 Comments
 
LVL 10

Expert Comment

by:jmanishbabu
ID: 38858806
0
 
LVL 10

Expert Comment

by:jmanishbabu
ID: 38858807
Configuring a Cisco PIX Firewall for Syslog
0
 
LVL 10

Expert Comment

by:jmanishbabu
ID: 38858808
0
Major Incident Management Communications

Major incidents and IT service outages cost companies millions. Often the solution to minimizing damage is automated communication. Find out more in our Major Incident Management Communications infographic.

 

Author Comment

by:omar07
ID: 38858846
ASA is already configured to send syslog messages to the syslog server.
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 38858857
Ii your PC and the switch are in the same subnet?
0
 

Author Comment

by:omar07
ID: 38858909
The switch is in different subnet of the syslog server
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 38858917
No, no, you say you can ping syslog server from PC but can not ping it from the switch. PC and switch, are the in the same subnet?
0
 

Author Comment

by:omar07
ID: 38858939
Yes PC and switch in the same subnet, I can ping from the PC , but not from the switch.
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 38858963
Do you have any other IPs configured on the switch?

The reason i am asking is that Cisco switches can have multiple interface vlan configured, and when you ping from the switch, you need to specify a source ip address
0
 

Author Comment

by:omar07
ID: 38858982
Only one vlan, and IP configured in the switch.
0
 
LVL 37

Expert Comment

by:ArneLovius
ID: 38873489
I presume that the switch is "outside" and the syslog server in "inside"

Are the "inside" and "outside" interfaces on the ASA both on private addresses ?

Does the switch have a management interface on the same subnet as the hosts that are connected to it ?

What is the default gateway of the switch ?

Is the ASA in "bridge" mode ? routed mode ? or routed mode with NAT ?
0
 

Author Comment

by:omar07
ID: 38874796
Hello,
The switch is on the inside network and the syslog server is on users network.
The outside interface is public ip address
The management interface is disabled, and the syslog server is on the users network.
the default gateway is pointing the inside interface of the ASA (inside)
The ASA is in routed mode.
0
 
LVL 17

Expert Comment

by:pergr
ID: 38874883
The switch needs to have a default-gateway configured, and pointing to the ASA.
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 38874950
please shoe the configs
0
 

Author Comment

by:omar07
ID: 38874985
The switch has default gateway and pointing to the inside interface of the ASA not to the users interface where the syslog server reside.
0
 

Author Comment

by:omar07
ID: 38874988
please find attached diagram
logserver-001.jpg
0
 
LVL 34

Expert Comment

by:Istvan Kalmar
ID: 38875035
Hi,

Do you have acl between inside and user for enable syslog?
0
 

Author Comment

by:omar07
ID: 38875058
I can ping from inside to the syslog server and I can ping from the syslog server to the inside, but not to the switch, because I added route in each PC to the inside network
0
 
LVL 18

Expert Comment

by:fgasimzade
ID: 38875062
Whats is your defaulte gateway on PCs? Why did you have to manually add routes?

Try adding a route on the switch as well
0
 

Author Comment

by:omar07
ID: 38875119
I'm sorry, I can ping from the switch to the log server, but I'm not getting any logs.
0
 
LVL 17

Expert Comment

by:pergr
ID: 38875785
You need a rule on the ASA that will allow syslog messages.

Just because ping (icmp) is allowed, it does not mean syslog is allowed.
0
 

Author Comment

by:omar07
ID: 38875987
the switch is in the inside network security level 100 and the syslog server in users interface security level 99. Do I still need rule for the switch to send syslog messages to the syslog server
0
 
LVL 37

Accepted Solution

by:
ArneLovius earned 500 total points
ID: 38876584
if you only have the default rule, you don't, if you have added any rules, then you might.
0

Featured Post

Efficient way to get backups off site to Azure

This user guide provides instructions on how to deploy and configure both a StoneFly Scale Out NAS Enterprise Cloud Drive virtual machine and Veeam Cloud Connect in the Microsoft Azure Cloud.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
This paper addresses the security of Sennheiser DECT Contact Center and Office (CC&O) headsets. It describes the DECT security chain comprised of “Pairing”, “Per Call Authentication” and “Encryption”, which are all part of the standard DECT protocol.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

737 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question