topic ICMP Logging Gone Wild! in Network Security

ICMP Logging Gone Wild!

jradke — Mon, 11 Mar 2019 22:11:20 GMT

Goal:

How do I disable these ICMP messages on my ASA? Version 8.0(3)6

Problem:

In my log file I have 343520 entries per hour of just ICMP messages! We're installing some new equipment and it does a plentiful amount of ICMP traffic which is used for its HA functions. Unfortunately, its filling up my ASA firewall logs with ICMP build and teardown messages like this:

Jan 6 09:44:47 10.55.33.7 %ASA-6-305012: Teardown dynamic ICMP translation from PMETA-MGMT:10.55.30.101/31276 to OUTSIDE-IF:65.182.XYZ.51/33778 duration 0:00:30

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/19511 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/28984 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 10.55.30.101/28984 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/29240 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/29240 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-305011: Built dynamic ICMP translation from PMETA-MGMT:10.55.30.101/30008 to OUTSIDE-IF:65.182.XYZ.51/34016

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34016 laddr 10.55.30.101/30008

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34016 laddr 10.55.30.101/30008

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33984 laddr 10.55.30.101/20535

Jan 6 09:44:47 10.55.33.7 %ASA-6-305012: Teardown dynamic ICMP translation from PMETA-MGMT:10.55.30.101/38956 to OUTSIDE-IF:65.182.XYZ.51/33781 duration 0:00:30

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/21047 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/11577 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 10.55.30.101/11577 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/11833 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/11833 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan 6 09:44:47 10.55.33.7 %ASA-6-305011: Built dynamic ICMP translation from PMETA-MGMT:10.55.30.101/12601 to OUTSIDE-IF:65.182.XYZ.51/34020

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34020 laddr 10.55.30.101/12601

Jan 6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34020 laddr 10.55.30.101/12601

Jan 6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33988 laddr 10.55.30.101/27959

Here's what I've tried:

I removed icmp inspect from the global policy
I setup rules for ICMP for the different zones
I've also disabled logging for the ICMP rules

Here's what I've found:

Sadly, the new piece of equipment is not using the same ICMP identifier for its continuous pings. This gear is using 4 IP's on the same subnet each pinging 3 other devices once per second (12pps) which results in the lengthy log files. When I sniff the traffic I see that the ICMP identifier BE and LE are unique for each ping even to the same destination IP. Where as a normal ping like from a Linux box uses the same identifier BE/LE for that ping instance for each ICMP request which only results in a 4 log entries for either 1 ping or 55000 at 1pps or 3000pps.

Re: ICMP Logging Gone Wild!

Marvin Rhoads — Fri, 06 Jan 2012 17:53:54 GMT

To prevent the security appliance from generating a particular system log message, enter the following command:

hostname(config)# no logging message message_number

For example:

hostname(config)# no logging message 302021

ICMP Logging Gone Wild!

varrao — Fri, 06 Jan 2012 17:54:05 GMT

How are you disabling icmp logs???

are you using the command:

no logging message 302021

no logging message 302020

This shoudl definitely not log these messages.

Can you provide an out of "show run logging" from the fiorewall.

Thanks,

Varun

ICMP Logging Gone Wild!

jradke — Fri, 06 Jan 2012 18:10:13 GMT

FIXED!

Oh how refreshing, this fixed my problem! You guys rock! THANK YOU!

no logging message 305011

no logging message 305012

no logging message 302020

no logging message 302021

I was using the 'log disable' command at the end of the rule to try to disable the logging which was ineffective:

access-list Inside_access_in_2 extended permit icmp any any log disable

Re: ICMP Logging Gone Wild!

Marvin Rhoads — Fri, 06 Jan 2012 18:35:22 GMT

You're welcome.

The entry you tried would disable generation of syslog entries by the access-list itself.

The log entries you were seeing were not a result of access-list hits but rather generic log messages enabled as a result of your global logging level. If you deem you don't want any informational (level 6) messages, you could use the command:

logging level 5

...with the result being you would only see notifications or higher priority messages.

The entries you disabled are all level 6 (informational). See this reference. Personally I usually prefer to move the global level up or down a notch so as not to have to keep track of individual messages I may have disabled.

Besides doing that for syslog you can also set it separately for the ASDM log using:

logging asdm [logging_list | level]

ICMP Logging Gone Wild!

varrao — Fri, 06 Jan 2012 18:44:44 GMT

Hey Thanks

The logging disabled by you is only for s pecific ACL not for the entire icmp traffic through the box, so you would need to disable it globally.

You can refer to this doc for any logging help:

https://supportforums.cisco.com/docs/DOC-18813

Hope that helps,

Thanks,

Varun

ICMP Logging Gone Wild!

jradke — Fri, 06 Jan 2012 18:57:34 GMT

Very good information guys, much appreciated!

Re: ICMP Logging Gone Wild!

pgasparovic — Fri, 07 Jun 2019 13:38:08 GMT

Very useful even in 2019, thanks you both (inc other guy) for answers and guy who raised this!