topic Re: ASA log message format in Network Security

ASA log message format

APatotski — Mon, 11 Mar 2019 15:53:11 GMT

My ASA5540 sends syslog message to ASDM console in the following format:

6 Jul 09 2009 302013 20:54:13 81 10.48.17.16 10.11.16.2 59279 Built outbound TCP connection 9660652 for Outside:10.11.16.2/81 (10.11.16.2/81) to Inside:10.48.17.16/59279 (10.48.17.16/59279)

The connection is initiated from the inside host 10.48.17.16 to outside host 10.11.16.2. But the ip address 10.11.16.2 is in the source ip address column and 10.48.17.16 is in the destination ip address column.

Is it bug or feature?

Re: ASA log message format

APatotski — Thu, 09 Jul 2009 17:28:05 GMT

I have added the Screenshot.

Re: ASA log message format

robertson.michael — Thu, 09 Jul 2009 17:58:20 GMT

Hi Aliaksandr,

I agree the format is a little counter intuitive. These syslog messages always list the lower security interface first (outside in your case), followed by the higher security interface (inside in your case). This is always the case, regardless of the direction of the connection.

The inbound/outbound keyword is actually what denotes the direction of the connection, not the addresses themselves. So, since your message says "Built outbound", you know that the connection originated from the inside. If the message says "Built inbound", you know that the connection originated from the outside.

Hope that helps.

-Mike

Re: ASA log message format

APatotski — Thu, 09 Jul 2009 18:08:07 GMT

Hi Michael,

Thank you for reply.

Best Regards.