topic Re: Deny inbound protocol 41 in Network Security

Deny inbound protocol 41

handsy — Mon, 11 Mar 2019 21:14:07 GMT

Recently I've started getting absolutely hundreds of protocol 41 deny alarms on my ASA firewall outside interface. These are flooding my syslog and making it hard to check for other issues that may be going on in our network.

Most are from 94.245.121.x addresses which appear to be owned by Microsoft!

Example

19-08-2011 08:22:34 Local4.Error firewall1 %ASA-3-106010: Deny inbound protocol 41 src internet:94.245.121.211 dst internet:x.x.x.x

Can anyone help me understand these alerts better? Should I be concerned?

Protocol 41 seems to be IPv6 to IPv4 tunneling protocol (6in4).

Thanks

Re: Deny inbound protocol 41

Anu M Chacko — Fri, 19 Aug 2011 07:36:54 GMT

Hi,

The message means that the ASA is dropping this connection since it failed a security check. Too many unwanted syslogs can affect other resources like CPU, etc. If you are not aware of the IP address 94.245.121.211, just shun this IP with command "shun 94.245.121.211". This will drop all packets from this source without processing it against any checks.

Hope this helps!

Regards,

Anu

P.S. Please mark this question as answered if it has been resolved. Do rate helpful posts.

Deny inbound protocol 41

handsy — Fri, 19 Aug 2011 08:17:11 GMT

Thanks for quick reply, but I guess what I'm after is someone to tell me why Microsoft IP addresses are constantly hitting my firewall on protocol 41?

Deny inbound protocol 41

Anu M Chacko — Fri, 19 Aug 2011 08:31:00 GMT

Hi,

Do you have a host on the inside that is has an application that uses the 6to4 protocol? It is possible that there is, which requests this kind of traffic or to open ports. I suggest you track down that host and disable the application if you don't need it. Here's a good link:

http://www.ipv6tf.org/index.php?page=using/connectivity/6to4

Hope this helps!

Regards,

Anu

P.S. Please mark this question as answered if it has been resolved. Do rate helpful posts.