topic Re: ASA syslog message in Network Security https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029930#M919550 <HTML><HEAD></HEAD><BODY><P>Why would the firewall log a ARP response collision? I believe the IP may be associated with Cisco switches: 2 x 2960G and 3560G. We are on one network/subnet. I recently configured a network 2 months ago and forgot where I documented the passwords to the switches and if I assigned IPs to the switches. Any suggestions to password recovery on the switches? Would password recovery procedure on the switches effect production environment? Thanks.</P></BODY></HTML> Mon, 26 May 2008 18:05:08 GMT saidfrh 2008-05-26T18:05:08Z ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029926#M919546 <P>The firewall syslog message shows "..Received ARP response collision from 10.168.1.254/001d.e6f2.f7c0 on interface Inside. I can not see any documentation for 10.168.1.254/001d.e6f2.f7c0. Any suggestions on how to track the IP/mac address? Thanks</P> Mon, 11 Mar 2019 12:50:04 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029926#M919546 saidfrh 2019-03-11T12:50:04Z Re: ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029927#M919547 <HTML><HEAD></HEAD><BODY><P>Well that mac address is a Cisco mac address - so I would check your configuration on your layer 3 devices!</P><P></P><P>To track it down - in your core router:-</P><P></P><P>show arp | inc 001d.e6f2.f7c0 or show arp | inc 10.168.1.254</P><P></P><P>HTH.</P></BODY></HTML> Mon, 26 May 2008 16:29:47 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029927#M919547 andrew.prince 2008-05-26T16:29:47Z Re: ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029928#M919548 <HTML><HEAD></HEAD><BODY><P>Do you know why there would be a ARP response collision? </P><P>05-26-2008 09:06:55 Local4.Warning 10.168.1.10 May 26 2008 09:10:56: %ASA-4-405001: Received ARP response collision from 10.168.1.254/001d.e6f2.f7c0 on interface Inside</P><P>Thanks</P></BODY></HTML> Mon, 26 May 2008 16:52:39 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029928#M919548 saidfrh 2008-05-26T16:52:39Z Re: ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029929#M919549 <HTML><HEAD></HEAD><BODY><P>Firstly - what device on your network has the address 10.168.1.254?</P><P></P><P>Secondly - have you traced the device that has MAC address 001d.e6f2.f7c0</P><P></P><P>Arp collisions are - interesting, to fully understand why you are seeing them, you need to know the answer to the above questions?</P></BODY></HTML> Mon, 26 May 2008 17:45:13 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029929#M919549 andrew.prince 2008-05-26T17:45:13Z Re: ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029930#M919550 <HTML><HEAD></HEAD><BODY><P>Why would the firewall log a ARP response collision? I believe the IP may be associated with Cisco switches: 2 x 2960G and 3560G. We are on one network/subnet. I recently configured a network 2 months ago and forgot where I documented the passwords to the switches and if I assigned IPs to the switches. Any suggestions to password recovery on the switches? Would password recovery procedure on the switches effect production environment? Thanks.</P></BODY></HTML> Mon, 26 May 2008 18:05:08 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029930#M919550 saidfrh 2008-05-26T18:05:08Z Re: ASA syslog message https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029931#M919551 <HTML><HEAD></HEAD><BODY><P>the link below describes the password recovery procedure for the Cisco Catalyst switches you are using. you will need to Power the switch and bring it to the switch: prompt so yes the password recovery will affect production so i suggest you do it out of work hours</P><P></P><P><A class="jive-link-custom" href="http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml" target="_blank">http://www.cisco.com/en/US/products/hw/switches/ps628/products_password_recovery09186a0080094184.shtml</A></P></BODY></HTML> Mon, 26 May 2008 20:16:11 GMT https://community.cisco.com/t5/network-security/asa-syslog-message/m-p/1029931#M919551 francisco_1 2008-05-26T20:16:11Z