ICMP Logging Gone Wild!

[jradke]

Goal:

How do I disable these ICMP messages on my ASA? Version 8.0(3)6

Problem:

In my log file I have 343520 entries per hour of just ICMP messages! We're installing some new equipment and it does a plentiful amount of ICMP traffic which is used for its HA functions. Unfortunately, its filling up my ASA firewall logs with ICMP build and teardown messages like this:

Jan  6 09:44:47 10.55.33.7 %ASA-6-305012: Teardown dynamic ICMP translation from PMETA-MGMT:10.55.30.101/31276 to OUTSIDE-IF:65.182.XYZ.51/33778 duration 0:00:30

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/19511 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/19511 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/28984 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 10.55.30.101/28984 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/29240 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/29240 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-305011: Built dynamic ICMP translation from PMETA-MGMT:10.55.30.101/30008 to OUTSIDE-IF:65.182.XYZ.51/34016

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34016 laddr 10.55.30.101/30008

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34016 laddr 10.55.30.101/30008

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33984 laddr 10.55.30.101/20535

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33984 laddr 10.55.30.101/20535

Jan  6 09:44:47 10.55.33.7 %ASA-6-305012: Teardown dynamic ICMP translation from PMETA-MGMT:10.55.30.101/38956 to OUTSIDE-IF:65.182.XYZ.51/33781 duration 0:00:30

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/21047 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/21047 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/11577 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 10.55.30.101/11577 gaddr 10.55.31.50/0 laddr 10.55.31.50/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 10.55.30.101/11833 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 10.55.30.101/11833 gaddr 10.55.30.1/0 laddr 10.55.30.1/0

Jan  6 09:44:47 10.55.33.7 %ASA-6-305011: Built dynamic ICMP translation from PMETA-MGMT:10.55.30.101/12601 to OUTSIDE-IF:65.182.XYZ.51/34020

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built outbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34020 laddr 10.55.30.101/12601

Jan  6 09:44:47 10.55.33.7 %ASA-6-302020: Built inbound ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/34020 laddr 10.55.30.101/12601

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33988 laddr 10.55.30.101/27959

Jan  6 09:44:47 10.55.33.7 %ASA-6-302021: Teardown ICMP connection for faddr 65.182.XYZ.1/0 gaddr 65.182.XYZ.51/33988 laddr 10.55.30.101/27959

Here's what I've tried:

1. I removed icmp inspect from the global policy
2. I setup rules for ICMP for the different zones
3. I've also disabled logging for the ICMP rules

Here's what I've found:

Sadly, the new piece of equipment is not using the same ICMP identifier for its continuous pings. This gear is using 4 IP's on the same subnet each pinging 3 other devices once per second (12pps) which results in the lengthy log files. When I sniff the traffic I see that the ICMP identifier BE and LE are unique for each ping even to the same destination IP. Where as a normal ping like from a Linux box uses the same identifier BE/LE for that ping instance for each ICMP request which only results in a 4 log entries for either 1 ping or 55000 at 1pps or 3000pps.

[Marvin Rhoads · Accepted solution]

To prevent the security appliance from generating a particular system log message, enter the following command:

hostname(config)# no logging message message_number

For example:

hostname(config)# no logging message 302021

[varrao · Accepted solution]

How are you disabling icmp logs???

are you using the command:

no logging message 302021

no logging message 302020

This shoudl definitely not log these messages.

Can you provide an out of "show run logging" from the fiorewall.

Thanks,

Varun

[jradke]

FIXED!

Oh how refreshing, this fixed my problem! You guys rock! THANK YOU!

no logging message 305011

no logging message 305012

no logging message 302020

no logging message 302021

I was using the 'log disable' command at the end of the rule to try to disable the logging which was ineffective:

access-list Inside_access_in_2 extended permit icmp any any log disable

[Marvin Rhoads]

You're welcome.

The entry you tried would disable generation of syslog entries by the access-list itself.

The log entries you were seeing were not a result of access-list hits but rather generic log messages enabled as a result of your global logging level. If you deem you don't want any informational (level 6) messages, you could use the command:

logging level 5

...with the result being you would only see notifications or higher priority messages.

The entries you disabled are all level 6 (informational). See this reference. Personally I usually prefer to move the global level up or down a notch so as not to have to keep track of individual messages I may have disabled.

Besides doing that for syslog you can also set it separately for the ASDM log using:

logging asdm [logging_list | level]

[pgasparovic]

Very useful even in 2019, thanks you both (inc other guy) for answers and guy who raised this!

[varrao]

Hey Thanks

The logging disabled by you is only for s pecific ACL not for the entire icmp traffic through the box, so you would need to disable it globally.

You can refer to this doc for any logging help:

https://supportforums.cisco.com/docs/DOC-18813

Hope that helps,

Thanks,

Varun

[jradke]

Very good information guys, much appreciated!