topic Re: ASDM Location Misconfigured in Network Security

ASDM Location Misconfigured

Jim Kingery — Fri, 21 Feb 2020 16:25:25 GMT

NOTE: IP and other information posted has been changed from actual config...

I have a firewall where ASDM put in the following statement when somebody was setting up/configuring the firewall.

asdm location 192.168.0.0 255.255.255.0 outside

However, the firewall interface on that subnet is assigned to the inside interface, see below.

interface GigabitEthernet0
description LOCAL LAN
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0

For the most part, this firewall is functioning. There are some odds and ends that aren't functioning properly. One in particular is a logging statement similar to the following.

logging host outside 172.16.0.199 17/5804

On the above referenced host we are receiving syslog messages. However, they are coming in on the default, UDP 514. In short, my question is the fact that the ASDM location for the 192.168.0.0/24 subnet going to cause any problems?

Re: ASDM Location Misconfigured

johnd2310 — Thu, 01 Nov 2018 00:35:22 GMT

Hi,

"Asdm location" is added by ASDM. You should not be adding this command manually.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa-command-reference/A-H/cmdref1/a3.html

What is the rest of the logging configuration. Is the syslog server listening on port 5804 and 514?

Thanks

John

Re: ASDM Location Misconfigured

Jim Kingery — Thu, 01 Nov 2018 14:22:20 GMT

Thank you. I am aware that the ASDM location statement is automatically added and should not be modified manually.

Below are the logging statements currently configured.

logging enable
logging timestamp
logging buffered debugging
logging trap informational
logging asdm informational

The syslog host is only listening on port 5804. I ran a packet capture on the host and I see syslog traffic originating from the firewall, but the destination port of the traffic is 514. As the syslog server is not configured to listen on 514, it is returning ICMP type 3 destination port unreachable messages to the firewall.