topic Re: ASA Syslog Event 106001 in Network Security https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898251#M973855 <HTML><HEAD></HEAD><BODY><P>This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. Indeed that means the conn table removed the connection. Such kind of messages are usually generated due to bad server kernel implementation.</P></BODY></HTML> Fri, 12 Oct 2007 16:55:58 GMT didyap 2007-10-12T16:55:58Z ASA Syslog Event 106001 https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898250#M973853 <P>I'm seeing a lot of events in our ASA logs for 106001 relating to external source TCP (port 80) connections being denied inbound to our PAT address. The sources are all valid web sites which users are accessing. If a source inside connects to a website outside, surely the return traffic will be permitted without needing any extra ACLs?</P> Mon, 11 Mar 2019 11:22:30 GMT https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898250#M973853 jason.scott 2019-03-11T11:22:30Z Re: ASA Syslog Event 106001 https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898251#M973855 <HTML><HEAD></HEAD><BODY><P>This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. Indeed that means the conn table removed the connection. Such kind of messages are usually generated due to bad server kernel implementation.</P></BODY></HTML> Fri, 12 Oct 2007 16:55:58 GMT https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898251#M973855 didyap 2007-10-12T16:55:58Z Re: ASA Syslog Event 106001 https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898252#M973856 <HTML><HEAD></HEAD><BODY><P>So the websites generating these messages are at fault rather than anything wrong with our configuration or something malicious?</P></BODY></HTML> Mon, 15 Oct 2007 06:14:45 GMT https://community.cisco.com/t5/network-security/asa-syslog-event-106001/m-p/898252#M973856 jason.scott 2007-10-15T06:14:45Z