topic Re: Syslog ID 852001 & 852002 in Network Security

Syslog ID 852001 & 852002

Chess Norris — Mon, 23 Jan 2023 14:39:31 GMT

Hello,

I recently observed our FTD is getting flooded with lots of Syslog ID 852001 & 852002 messages.

It basically hundreds of those messages every minute (example below)

Jan 23 2023 02:51:59: %FTD-6-852002: Received Full Proxy to Lightweight event from application Snort for TCP flow 10.199.254.162/27607 to 10.10.1.94/47873
Jan 23 2023 02:51:59: %FTD-6-852001: Received Lightweight to full proxy event from application Snort for TCP flow 10.14.38.1/27789 to 10.20.8.146/8726
Jan 23 2023 02:51:59: %FTD-6-852002: Received Full Proxy to Lightweight event from application Snort for TCP flow 10.14.38.1/27789 to 10.20.8.146/8726
Jan 23 2023 02:52:04: %FTD-6-852001: Received Lightweight to full proxy event from application Snort for TCP flow 10.14.38.1/34260 to 10.10.1.101/8726

I've read the explanation here

https://www.cisco.com/c/en/us/td/docs/security/firepower/Syslogs/b_fptd_syslog_guide/syslogs10.html#id_122205

but it's a bit vague and we dont have any SSL policys and I just started to noticed those messages recently.

Does anyone have an idea on what might trigger those messages?

There is also not possible to filter out those specifik syslog ID's due to a bug, which makes it even more frustrating

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx37329

Thanks

/Chess

Re: Syslog ID 852001 & 852002

Marvin Rhoads — Mon, 23 Jan 2023 15:02:01 GMT

I haven't come across it but, given the BugID you cited, I'd encourage you to open a TAC case.

Work on ENH (enhancement) bugs gets prioritized that way.

Re: Syslog ID 852001 & 852002

Chess Norris — Wed, 25 Jan 2023 07:33:55 GMT

Thanks. I'll open a case with TAC and see what they say.

/Chess

Re: Syslog ID 852001 & 852002

MHM Cisco World — Wed, 25 Jan 2023 13:08:23 GMT

I will check this Syslog message today.

Re: Syslog ID 852001 & 852002

Chess Norris — Fri, 24 Mar 2023 12:29:36 GMT

TAC raised the severity for the issue about not beeing able to rate limit those syslog IDs and just replied and told be that this should be fixed in version 7.4, which will most likely will be released in April. The issue is not only with those specific IDs, but rather for all syslog IDs over 805003 (In the range 805003 - 8300006)

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwe68840

/Chess

Re: Syslog ID 852001 & 852002

MHM Cisco World — Fri, 24 Mar 2023 12:26:05 GMT

Thanks alot for your update

Re: Syslog ID 852001 & 852002

adamgerber — Thu, 29 Jun 2023 06:50:56 GMT

Thank you for this - hope this gets fixed in 7.4.