Cisco Firewall :: 5550 Firewall Syslog Message
Feb 22, 2013I have cisco 5550 Firewall, one messages appear in syslog server from Firewall, (warning) i want to stop this message from appearing syslog traps.
View 2 Replies
ADVERTISEMENT
Cisco Firewall :: ASA 305006 - Syslog Error Message
Dec 19, 2011I keep getting an error message, i've tried several things to resolve it but still no success.This is the exact error message:
regular translation creation failed for protocol 41 src Customer: dst outside:
Cisco Firewall :: Changing Syslog Message 106100 Severity Level?
Mar 5, 2012I'm fine tuning some of our ASA logging config, and am having an issue with one particular syslog ID.The message is: syslog 106100: default-level informational (enabled)and the log settings are:
Syslog logging: enabled
Facility: 20
Timestamp logging: enabled
Standby logging: disabled
Debug-trace logging: disabled
[code]....
This ACE log entry is generated by explicit deny any any statements at the end of all the ACLs, e.g.access-list inside_access_in extended deny ip any any log interval 600 Based on the config, I would expect to see this being logged to the syslog server, but not to the local buffer, but am still seeing them locally in the buffer:
Feb 22 2012 10:58:20: %ASA-4-106100: access-list inside_access_in denied udp INSIDE/HOSTABC(52629) -> OUTSIDE/HOSTXXX(162) hit-cnt 5 300-second interval [0x3baecf1e, 0x0]
It also still shows these as level "warning", %ASA-4-106100, instead of the default %ASA-6-106100 I've tried removing and re-applying the config at different levels but it still reports in the buffer log as level "warning", %ASA-4-106100 This also doesnt affect every 106100 log that is generated. Most messages are generated at the correct level 6 severity but some seem to randomly log at level 4. There doesn't seem to be any pattern to this. The same access-list line can produce severity level 4 and 6 106100 messages.
Cisco Firewall :: ASA 5500 Syslog Not Getting Captured In Centralised Syslog Server
Jan 15, 2012Recently i have upgraded the IOS of ASA5550 (in HA mode) to 8.4.2 from 8.0.5, after OS upgrade we found that the syslog from thses firewalls are not getting captured/transfered to centralised syslog server. The server is reachable from the firewalls.
View 3 Replies View RelatedCisco Firewall :: 5550 Firewall Set Up For Redundant Purpose
Mar 3, 2011i two 5550 firewall set up for redundance purpose . in failover we define two different ip add one for primary and one for secondary .interface Ethernet0/0 nameif outside security-level 0 ip address xxxx.0.0.0.1 255.255.255.0 standby xxxx.0.0.2!interface Ethernet1/0 nameif inside security-level 100 ip address 10.0.0.12 255.255.255.0 standby 10.0.0.11.default gateway for host will be 10.0.0.12 (primary fw address) however in case of failover , the secondary fw will be up with ip address that was assigned for primary .in this case the secondary ip add 10.0.0.11 is actually nerver used? similarly do i need to have two public ip address for outside (one for primary and one for secondary ) ? or in case if primary fails the secondary comes onlie and take the ip of primary fw . hence i only need to purchase just one ip address.
View 6 Replies View RelatedCisco Firewall :: Secondary ASA 5550 Firewall Getting Down Automatically?
Apr 17, 2011I am having two ASA 5550 firewall running in active/standby mode. With in last two months our secondary firewall got down automatically 3 times. Firewall is running with IOS version 7.1.2. how to proceed further troubleshooting because there are not any logs on firewall.
View 3 Replies View RelatedCisco WAN :: Syslog Message On 3845
Nov 12, 2011I received a syslog message on my cisco 3845 router, what is that message mean. 11 13:36:06.265 UTC: ASSERTION FAILED: file "../les/if_ng_dslsar_tx.c", line 385
View 2 Replies View RelatedCisco WAN :: C6509 - Error Message In Syslog
Sep 15, 2009We have 2 Cat 6509 connected to 1 Gbps Ethernet WAN Link. On each 6509 we use 2 Gbps IPSec SPA Encryption cards for Encryption. The encrypted traffic goes to a GRE Tunnel. This morning I found some error messages in syslog.
%CONST_DIAG-SP-3-HM_TEST_FAIL: Module 1 TestIPSecEncrypDecrypPkt consecutive failure count:2
There were also several short tunnel downs/ups. I wonder if there is a bug in the new IOS image 12.2(33)SXI2a. We upgraded to this image last weekend.
Cisco :: 2431 EEM Applet Event From SIP Syslog Message
Jul 27, 2011I want to use an EEM applet on a Cisco IOS 2431 voice gateway running 15.1(2)T to take action upon expiration of a SIP registration (with its sip registrar). I thought that it might be possible to use existing error messages generated by the ios sip application to trigger an EEM applet.Is there a reference that lists all SYSLOG messages that SIP can generates, and their error levels? Can you show me how to turn on syslog messages, so that I can cause a SIP registration expiration on my GW and then see what SYSLOG messages are produced?
I think I understand how to write an applet and its event trigger from a SYSLOG message pattern, but I am having trouble seeing any SIP error messages at all, except if I turn on Debug, which usually produces way too many messages and may impact performance.
Cisco Wireless :: Client Association Syslog Message With 5500 Wlc
Sep 16, 2012It is a Customer requirement to send 802.11 client association/disassociation logs to the Syslog server in a Unified Wireless system. (AIR-CT5508 + LAP1142) [code] Unfortunately I didn't find such logs even in Msg Log with the severity level set to debugging.I was able to do client assoc/disassoc logging with SNMP trap + trap receiver software, BUT is there any way to do this with Syslog?
View 1 Replies View RelatedCisco Wireless :: WLC 7.0.98.0 / How To Convert Snmp Trap To Be Syslog Message
Aug 22, 2011Now I'm trying to write software that get information from Syslog message, but I'm facing with the problem about getting statistic of client de-authenticated in a WLC (Software Version: 7.0.98.0), because I cannot find any log about this information on WLC except only this SNMP trap:
Tue Aug 23 09:52:28 2011Client Deauthenticated: MACAddress:00:xx:77:2c:06:db Base Radio MAC:00:xx:5d:0c:fc:30 Slot: 0 User Name: unknown Ip Address: 10.2xx.47.15 Reason:Unspecified ReasonCode: 1
So, is there any way that I can configure WLC to convert this SNMP trap to send to Syslog server as a normal Syslog message?
Cisco :: 4402 WLC - Syslog Message / Unable To Allot AP Entry In Database
Feb 23, 2011Receiving the following syslog message from a 4402 WLC:
%CAPWAP-3-AP_DB_ALLOC: capwap_ac_db.c:145
Unable to allot AP entry in database. We receive this message about once a minute on average. I can't find any documentation saying what it is. It looks like a database error, which makes think it might be a memory issue or an issue with having too many AP's on the WLC. However, that controller has less than 30 AP's on it.
Cisco Switching/Routing :: 4096 / Syslog Message And Logging Command
Sep 21, 2012logging buffered 4096 warnings The above causes router to log all the events with severity level 4 or below in buffer.What about logging console warnings command?will the above command cause router to send log messages with severity level 4( warnings severity level) to console only or will the router send all the log messages with severity level 4 or below to console ?
View 3 Replies View RelatedCisco Firewall :: ASA 5550 Two ACL From Outside To Inside
May 13, 2011I have ASA5550 ruuning Version 8.3(1) with inside and outside interfaces as below [code] On the inside : I have a server (10.20.10.36) that need to be accessed from an outside host (Y.Y.131.34) , so I have the below NAT/ACL rules. [code] is it right that I have to add two ACL entry for outside host to the NATed IP of the inside server , then again add another ACL entry from the same outside host to the private IP of my inside server o get this communication done?
View 7 Replies View RelatedCisco Firewall :: ASA 5550 With IOS 8.0(2) Crashes
Jan 31, 2012we had just installed our ASA 5550 with IOS 8.0(2) a couple of week ago.
2 interfaces from each slot are being used ie 0/0 for Branch users comming via MPLS cloud , 0/1 for internal LAN users comming form Core Switch & 1/0 for Server farm LAN , 1/1 for Internet (outside)
the first 3 interface are considered inside with sec set at 100 while the 1/1 is outside with sec at 0.
Last night it suddenly started dropping all connections without any warning or any noticible log form the ASDM logging.
the connection drop would happen for 2 - 3 minutes and would work fine for the next 15 minutes or so..
after conencting the console , we found out that the IOS would suddelny go abrupt and show this display ...
TP-ASA(config)# TP-ASA(config)# TP-ASA(config)# Thread Name: Dispatch UnitPage fault: Address not mapped vector 0x0000000e edi 0x24d184b0 esi 0x0000000d ebp 0x1c6ceaf8 esp 0x1c6ceae0 ebx 0x09e965e0 edx
[Code]....
Cisco Firewall :: 5550 - How To Do NAT Exemption With V8.4
Oct 4, 2011I have looked in the books I have (Cisco ASA, PIX and FWSM; ASA 8.0) and googled a good bit but can't seem to find any specific mention of how to do NAT exemption with v8.4. It seems NAT exemption (NAT 0 access-list) was deprecated. Using ASDM, there's no corresponding menu item for this that is obvious.
We have public addresses inside the ASA and want to allow in/outbound connections using these IP's without NAT. The ASA is a 5550.
Cisco Switching/Routing :: Upgraded 2960 Switches To 15.0 (1) SE - Syslog Message On Bootup
Oct 8, 2011I recently upgraded a few 2960 switches to 15.0(1)SE, and while they are working fine, I did notice a strange syslog message upon boot-up that wasn't previously there. [code] I did some cursory searching via google but nothing useful presented itself.
View 7 Replies View RelatedCisco Firewall :: ASA 5510 Syslog Configuration?
Jul 30, 2011i want to configure asa 5510 to send syslog messages to syslog server which i placed in my inside interface. also if enableing syslog will inrease the cpu utilization or memory? the necessary configuration parts?
View 1 Replies View RelatedCisco Firewall :: Syslog Output Not Going To ASA 5510 On 8.2.2
May 24, 2011I have an asa5510 on 8.2.2. I have my logging configuration as below [code] I am not getting any syslog output to the syslog server. I'm using kiwi syslog server latest version. Have tried disabling/reenabling logging and changing inside host destinations. Is there another command needed
View 4 Replies View RelatedCisco Firewall :: Syslog Server Setup Pix 6.2?
May 9, 2011I need to setup a syslog server for PIX w/ 6.2 and was hoping to get detailed instruction how to go about it. I would like exact syntax w/ an example on the pix and any configuration on the computer that will be receiving the log info. I have downloaded tftpd32 onto computer
View 1 Replies View RelatedCisco Firewall :: ASA 5510 ACE Syslog Configuration
Dec 5, 2012I've a problem with syslog logging on my Cisco ASA 5510 version 8.2(1). I need to:
- 1) log some ACL with warning level to log deny access.
- 2) log some ACL with informational level to log permit and deny access (notification level log only deny access and not permit access).
- 3) not log others ACL.
For 1), I configured the syslog server with warnings level and i enabled the logging rules with default level (syslog default level)
logging enable logging trap warnings logging host "interface" "host" . access-list "interface" extended permit ip any any log default.
For 2), I enabled the logging rules with specific level (informational).
access-list "interface" extended permit ip any any log 6 interval 300.
For 3), I disabled the logging rules.
access-list "interface" extended permit ip any any log disable
My problem is that the syslog logging level bypass the ACL logging level. Even if some ACL are configured with informational level, the ASA send only warnings logs to the syslog. I tried to configure the syslog default level to warnings, to remove the ACL and then put it back again with the specific logging level but I still have the problem.
Cisco Firewall :: ASA 5550 IPv6 Compatibility?
May 21, 2013I need to understand if ASA 5550 ver 8.2(1) is comptible with IPv6, if not what is the upgrade path to make it IPv6 compatible. The requirement is dual stack of IPv4 and IPv6 should run in the same HA cluster and later will shift IPv6 completely.
The existing infrastructure is equipped with ASA with HA Active/Active mode. The command output for required details are attached here in txt mode.
Cisco Firewall :: High CPU Utilization On ASA 5550?
Mar 10, 2013I have Active Standby ASA5550 setup with VPN premium license. A few days back we had a requirement of SSL VPN connection for and we got a temporary from Cisco for same, this license expired and the ASA reverted to it's original license. 3 4 days after this we saw a sudden increase in CPU utilization (upto 90% + -5%) on the ASA during production hours but were not able to figure out the reason, in order to restore the services we failovered the firewall to secondary and everything worked fine. We were suspecting one of the following but there were no logs for any of this
1. The ASA hardware was haivng problem
2. Some client was doing a DoS attack to bring down the ASA (no logs for this as well).
We took a downtime to look further by failovering the ASA back to primary and it worked fine without any issues ruling out the 1st option. We also came across a licesing doc [URL]
Downgrading any license (for example, going from 10 contexts to 2 contexts).
# Note If a temporary license expires, and the permanent license is a downgrade, then you do not need to immediately reload the security appliance; the next time you reload, the permanent license is restored.
As per this doc, sooner or later a restart was required on the ASA. We restarted secondary ASA and everthing was fine but when we restarted the primary ASA by swtiching over to secondary some of the server (not all) in the DMZ stopped working (even ICMP unreachable) and only came back to normal when the primary ASA was restored and working fine (with failover).
The reboot was done by shuting down the physical link between the Core switch and ASA inside individually.
I am not sure what could be the issue that the servers in the DMZ wen unreachable.
Cisco Firewall :: ASA 5550 - Two Different Syslogs Servers?
Aug 9, 2010In my Cisco ASA 5550, I need to set two different syslogs servers, and I need to send the system logs to the first one (only admins login/logout), and the traffic logs and all the rest (informational level) to the second one. Do you know if is it possible or not and, if yes, how to configure it?
View 6 Replies View RelatedCisco Firewall :: ASA 5550 Active / Standby With SSL VPN
Jun 12, 2011I would like to work with two ASA's 5550 in HA (Acitve-Standby) like perimetral firewalls and also work with another ASA 5540 but like a SSL VPN Remote Access to end users.Which will be the best topology to this scenary?. Perhaps i need to put the ASA 5540 SSL VPN together with the ASA's in HA directly in a port.
View 1 Replies View RelatedCisco Firewall :: How Many Outside Interfaces Are Allowed On ASA 5550
Apr 26, 2011I am using an ASA5550 for a complex secure network that has at least six "outside" networks. Each "outside" network is assigned to a specific port each set at level "0". I also have a DMZ, set to level "50". I am having difficulty with passing traffic from a host in the DMZ to all but one of the "outside" networks. Is there a limit to the number of "outside" interfaces? I will provide a redacted config file as soon as possible.
View 3 Replies View RelatedCisco Firewall :: ASA 5550 - URL Filtering Using Web Sense?
May 10, 2013i have Cisco ASA 5550 and i want to do URL filtering using Web sense,can i use Micorsoft Forefront TMG2010 as websense server to do that?
the idea is to filter the HTTP & HTTPS URLs,if the Micorsoft Forefront TMG2010 is not suitable,refer to suitable Websense URL filtering server?
Cisco Firewall :: ASA 5550 Sending Reset With TTL Of 255
Oct 3, 2011I have the following problem, right now we have an ASA 5550 connected to the client´s side. A reset is being received on the client´s side, but when we run the sniffers on both extremes of the network, we can see that the reset is not being sent by the server´s side.
We have narrowed it down to the 5550 ASA, but have found no bug that matches the description.
The characateristics of the reset packet are the following:
- It is the only packet with a TTL of 255.
- Both server and client have very different window sizes, and the reset packet even though has the server´s ip and port as source of the packet, it has the client´s window size.
- It has a correct ack number.
-Before the reset is received, there are a couple of retransmissions of the last packet sent.
- We´re handling a VPN tunnel between both servers.
Cisco Firewall :: Does 5550 Contains Built In CSC / IPS Modules
Feb 7, 2011i m looking for asa 5550 product.Part # ASA5550-BUN-K9 - Cisco ASA 5550 Appliance with SW, HA, 8GE+1FE, 3DES/AES
1) does 5550 contains built in CSC / IPS modules.? why i m asking because the "quick refrence guide " indicates that expansion slots are not available.
2) can asa 5550 natively protects natively against networks attacks against virus / worms etc with out CSC OR IPS MODULE.?
Cisco Firewall :: ASA 5550 To ASA 5555-X Migration
Apr 23, 2013I am about to carry out a migration from ASA 5550 to ASA 5555-X, however I cannot find any detailed document or reliable tool for this migration.
View 4 Replies View RelatedCisco Firewall :: ASA 5550 Cannot Logon With ADSM
May 22, 2012I cannot logon with adsm anymore.when I run adsm, I type in my pw, and the screen keeps displaying "contacting the device". No timeout, just stays this way.I've updated the java version, no luck.I can connect with SSH with no problem. device = asa5550, 8.2(1) asdm 6.2(1) [code]
notice that there is no "with cookie-based authentication" here -- is this relevant?
Rebooting the device is not really an option.
Cisco Firewall :: ASA 5550 Flags E Connection
May 2, 2012I have an issue were thousands of connections on the ASA are marked with flags E, below is a visual of the connection. Any ideas what could cause this marking? Also, I can't grasp what the meaing of an outside back connection (ie flags E).
TCP DMZ:X.X.X.X/139 Inside:X.X.X.X/1828, flags E, idle 9h37m, uptime 9h37m, timeout 15s, bytes 0
Cisco Firewall :: Link Aggregation On ASA 5550?
Jan 10, 2011i'm installing a Firewall Cisco ASA 5550 with 8 Gigabit interfaces.
I have installed firmware 8.2.3.
Is it possible to make link aggregation on ASA to have more bandwith?