topic Disable logging of "Implicit Deny" in Network Security

Disable logging of "Implicit Deny"

vincehgov — Tue, 12 Mar 2019 01:43:22 GMT

Hi All,

My syslog is full of %ASA-4-106023: Deny tcp src outside:---- by access-group "inbound-acl" messages. I did not configure an explict deny for the access list to log these denies.

Can someone explain how I can disable logging of denied connections?

Vince

Disable logging of "Implicit Deny"

vincehgov — Wed, 15 May 2013 01:45:31 GMT

TAC had me issue the command "no logging message 106023". Seems to have worked.

Disable logging of "Implicit Deny"

patoberli — Wed, 15 May 2013 14:08:17 GMT

You could also try to add a deny ip ip any rule at the end, with the option no logging set. I sadly haven't got the right syntax at hand at the moment.

But in any case I would not disable this, as you can't see now if you get attacked in the logfiles, nor if any service is malfunctioning because of a missed open port.

Disable logging of "Implicit Deny"

sokakkar — Wed, 15 May 2013 16:52:07 GMT

Hi Vincent,

This log message is generated because someone is sending traffic which you have not allowed through your ASA. I would suggest that you check the source and destination in log and work towards finding the reason traffic is coming to your ASA.

ASA logging this is a good thing in a way that it keeps you informed about unwanted traffic ending up on your ASA, it also helps in troubleshooting in case something legit is getting denied in logs.

Once you fix the offending traffic, logs will stop anyways.

Else, add following explicit deny rule:

access-list inbound-acl deny ip any any

Sourav

Disable logging of "Implicit Deny"

vincehgov — Wed, 15 May 2013 19:31:27 GMT

Hi Sourav,

This is coming from the internet. How would you suggest I go about fixing the offending traffic?

Vince

Disable logging of "Implicit Deny"

sokakkar — Wed, 15 May 2013 20:13:44 GMT

Vincent,

Can you paste some sample logs? Hide the IP's if you want.

You mentioned that log file is flooded with above log message, is it coming from some specific IP's or from different IP's altogether.

If later, put explicit deny ip any any as I mentioned above. If specific IP's, we can look into it further.

Sourav

Disable logging of "Implicit Deny"

vincehgov — Wed, 15 May 2013 20:53:02 GMT

Hi Sourav,

I have thousands of the following line:

%ASA-4-106023: Deny tcp src outside:99.32.21.185/60905 dst inside:x.y.z.a/6970 by access-group "inbound-acl" [0x0, 0x0]

It seems to be coming from only one source. 99.32.21.185.

Thanks for your help!

Vince

Disable logging of "Implicit Deny"

patoberli — Thu, 16 May 2013 06:51:03 GMT

In this case you could write an abuse message to the ISP of this ip address. A quick whois revealed that it's an IP spaced owned by AT&T: http://whois.arin.net/rest/net/NET-99-0-0-0-1/pft

Write your abuse complaint to abuse@sbcglobal.net and abuse@att.net telling them that this IP is flooding your firewall with unwanted traffic.

Disable logging of "Implicit Deny"

sokakkar — Thu, 16 May 2013 11:56:46 GMT

Hi Vincent,

That tells the story then. If this is unexpected traffic to your server (which I am sure it is, that is why you don't have a permit acl for this), please take this matter up with your ISP and have them mitigate this at their end.

ASA is doing what it is supposed to: dropping the traffic and highlighting thsi to administrator.

Sourav

Disable logging of "Implicit Deny"

vincehgov — Thu, 16 May 2013 17:27:19 GMT

Thats great advice. Thanks guys.