topic Doubt with Log in Network Security

Doubt with Log

Diego Maciel Gomes — Mon, 11 Mar 2019 23:33:55 GMT

Hello All

I have some doubts with log of ASA...

If someone help me

Jul 23 16:54:42 11.11.11.11 %ASA-4-313005: No matching connection for ICMP error message: icmp src outside:172.20.20.20 dst inside:172.19.19.19 (type 3, code 3) on outside interface. Original IP payload: udp src 172.19.19.19/53 dst 172.20.20.20/61126.

172.20.20.20 = workstation

172.19.19.19 = server

Why this message?

Maybe any drop in my network because of it???

How can I fix it?

Thanks anyway.

Diego

Doubt with Log

Jennifer Halim — Tue, 24 Jul 2012 02:06:03 GMT

That means port is unreachable and from your error message since it's UDP/53, the DNS resolution either does not work, or it already passes through the timeout for DNS reply. As a safety measure the firewall will drop the packet if it doesn't receive the DNS reply within certain period of time, this is to prevent against DNS attack.

Doubt with Log

Diego Maciel Gomes — Tue, 24 Jul 2012 14:00:19 GMT

Hi Jennifer, thanks for your answer..

hum... I have the port udp/53 allowed...

Maybe a problem with the server??? Or anything I need to do on ASA?

Doubt with Log

Jennifer Halim — Tue, 24 Jul 2012 15:21:58 GMT

Yeah, seems like problem with the server if port is already allowed on the ASA.