topic Re: PIX Syslog Message in Network Security

PIX Syslog Message

klisagar — Fri, 21 Feb 2020 08:49:41 GMT

At what point does the PIX issue the 'connection built' syslog message. Example - 04 04 12:42:38 DMZPIX %PIX-6-302013: Built outbound TCP connection -668712345 for outside:xxx.xxx.xxx.xxx/1234 (xxx.xxx.xxx.xxx/1234) to inside:xxx.xxx.xxx.xxx/4514 (xxx.xxx.xxx.xxx/4514)

Is this done only after a completed TCP handshake or after an intial SYN (is this when PIX builds connection slot?)or some other citeria?

Re: PIX Syslog Message

Patrick Iseli — Fri, 07 Apr 2006 13:48:48 GMT

Syslog message 302013:

Error Message %PIX-6-302013: Built {inbound|outbound} TCP connection number for

interface_name:real_address/real_port (mapped_address/mapped_port) to

interface_name:real_address/real_port (mapped_address/mapped_port) [(user)]

Explanation A TCP connection slot between two hosts was created.

Where:

connection number is a unique identifier.

interface, real_address, real_port identify the actual sockets.

mapped_address, mapped_port identify the mapped sockets.

user is the AAA name of the user.

If inbound is specified, then the original control connection was initiated from the outside. For example, for FTP, all data transfer channels are inbound if the original control channel is inbound. If outbound is specified, then the original control connection was initiated from the inside.

Recommended Action None required.

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm#wp1054139

sincerely

Patrick

Re: PIX Syslog Message

klisagar — Thu, 20 Apr 2006 17:52:34 GMT

Thank you for the info Patrick, but that does entirely answer the question. Does the PIX create a connection slot upon seeing the intial SYN for the TCP handshake or is there other criteria.

Thanks you.