topic Cisco ASA Syslog Message 302013 in Network Security

Cisco ASA Syslog Message 302013

aneesh.kaimal — Tue, 12 Mar 2019 09:39:48 GMT

Cisco ASA syslog message 302013 (ASA-6-302013: Built inbound TCP connection) does it really means a established TCP connection (after 3 way handshake) or does it mean that just the SYN packet is allowed through the firewall?

Regards,

Aneesh Kaimal

I believe it is the inital

Marvin Rhoads — Thu, 06 Jul 2017 15:21:48 GMT

I believe it is the inital SYN packet that triggers the syslog message.

You can see further detail of a given connection by checking the flags as described in this document:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113602-ptn-113602.html

Re: Cisco ASA Syslog Message 302013

rraj1788 — Wed, 22 Jun 2022 18:04:42 GMT

Hi Aneesh,

I have enabled syslog messages to a remote syslog server set to logging level 6 but however I have never seen this events 302013,302014,302015,302016 at my end. Can you let me know how did you get the same configured and is it like by default this events are disabled to log.

Regards,

rraj1788