topic Re: Firewall log interpretation. in Network Security

Firewall log interpretation.

w-asaadmin — Mon, 11 Mar 2019 12:12:49 GMT

Hello All,

I just installed my ASA 5505 and the firewall log showed that it denied a connection from Ip address 74.9.151.50 every second. Please see the attached file.

What does the log message indicate and how to stop

ip address 74.9.151.50 from attacking my ASA.

Thank you for your help!!

Re: Firewall log interpretation.

brettmilborrow — Wed, 05 Mar 2008 22:36:15 GMT

do you have an icmp policy configured on your asa?

Try the following to check:

sh run | grep icmp

Re: Firewall log interpretation.

w-asaadmin — Thu, 06 Mar 2008 14:53:20 GMT

Thanks,

Here is the output:

ASA-ST# sh run | grep icmp

icmp unreachable rate-limit 1 burst-size 1

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

Re: Firewall log interpretation.

brettmilborrow — Thu, 06 Mar 2008 16:07:45 GMT

The icmp type and code is the clue here, Type 11 code 0 = Time to Live exceeded in Transit.

This generally points to a routing loop in a path to a particular host. However, these blocked packets could be response packets to an outbound traceroute test.

Re: Firewall log interpretation.

w-asaadmin — Thu, 06 Mar 2008 16:17:30 GMT

Thanks again,

What would you recommend?

Re: Firewall log interpretation.

brettmilborrow — Thu, 06 Mar 2008 16:20:52 GMT

Well, I would check to see if someone was trying a traceroute test at the time.

It all depends if you want to allow traceroutes out of your network. If not, do nothing, your firewall is working as it should.

If you do, you will need to allow the icmp packets back into your network using an ACL.