Go Premium for a chance to win a PS4. Enter to Win

x
?
Solved

ICMP traffic in firewall logs

Posted on 2014-01-23
8
Medium Priority
?
526 Views
Last Modified: 2014-02-04
Hi,
I am reviewing firewall logs and I am trying to understand this line.


Jan 18 10:08:39 logapps %ASA-6-303021: Teardown ICMP connection for faddr 141.000.100.2/0 gaddr 141.000.63.159/0 laddr 141.000.63.159/0


What does the faddr / gaddr and laddr mean?  Since it is a ping, one is the initator of the ping, the current address and the final address.... is that correct?

Thanks!
0
Comment
Question by:NYGiantsFan
  • 3
  • 2
  • 2
  • +1
8 Comments
 
LVL 7

Accepted Solution

by:
SvenIA earned 1000 total points
ID: 39803594
foreign address (one not in control by this ASA/router)

global address (after NAT)

local address (pre NAT)

So you are correct.....
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39803629
Scott says This
0
 
LVL 7

Expert Comment

by:SvenIA
ID: 39803642
@Miftaul

Isn't that exactly the same as what i posted?
0
Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

 

Author Comment

by:NYGiantsFan
ID: 39803753
The foreign address originated with our network?  Or is this nated.

What is the different between the global address and the local address?  They are appearing as the same.   Thanks.
0
 
LVL 11

Expert Comment

by:Miftaul
ID: 39803785
@SvenIA, yes thats it. I am on mobile, screen doesn't refresh. I didn't notice your comment earlier.
0
 
LVL 11

Assisted Solution

by:Miftaul
Miftaul earned 1000 total points
ID: 39803921
global address and the local address could be same when you are pinging from within ASA.
0
 
LVL 8

Expert Comment

by:amatson78
ID: 39808967
Sounds like that faddr might be a VPN address which is why it shows internal, do you run a VPN on that range?
0
 

Author Closing Comment

by:NYGiantsFan
ID: 39832933
Thanks!
0

Featured Post

Free Tool: Path Explorer

An intuitive utility to help find the CSS path to UI elements on a webpage. These paths are used frequently in a variety of front-end development and QA automation tasks.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Unable to change the program that handles the scan event from a network attached Canon/Brother printer/scanner. This means you'll always have to choose which program handles this action, e.g. ControlCenter4 (in the case of a Brother).
How to fix a SonicWall Gateway Anti-Virus firewall blocking automatic updates to apps like Windows, Adobe, Symantec, etc.
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

916 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question