"%HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has

[jmaxwellUSAF]

(I searched this at Cisco & Google without satisfaction)

Hello. I am troubleshooting symptom of sftp communication from internal server not reaching www address.

I see in 4431 Router logs...

*Feb 3 21:12:12.019: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:12.019: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:12.020: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:12.021: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:12.022: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:27.022: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:27.022: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:27.024: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:27.025: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.
*Feb 3 21:12:27.027: %HTTP-4-SERVER_CONN_RATE_EXCEED: Number of connections per minute has exceeded the maximum limit(500)as specified by the platform.

1. What typically causes this situation?

2. Might this be related to the root cause of my troubleshoot symptom?

Thank you.

[MHM Cisco World]

CSCvn36879 : Bug Search Tool (cisco.com)

[jmaxwellUSAF]

Thank you for your helpful reply.

1b. What is most likely causing this torrent of connections?

2b. Are these only vty/ssh connections to this 4431 router? 

3b. Why would so many attempts be made to this device?

The literature instructs remediation by inserting an ACL. OK. 4b. What will the result be of this ACL?

5b. Might this ACL suddenly break a production critical process?

Thank you.

[MHM Cisco World]

are you enable HTTP in Router ??

[jmaxwellUSAF]

I know very little about this device. It lives between ASA-5525 and www.

I only know traffic is lost leaving LAN, somewhere between...

ASA-5525 inside interface after ACL permit statement is hit, and www VENDOR1= 2.2.2.2

(Traffic fails before reaching 2.2.2.2)

[Georg Pauwen]

Hello,

I am not sure the SFTP to WWW problem you are experiencing is related to the log messages. The HTTP server functionality of the router is aimed at administering the router through a web interface. You could try and use a non-standard port, e.g.:

ip http server
ip http port 8001

to see if that reduces the log messages (and effectively the number of connections).

With regard to your issue:

-->  I am troubleshooting symptom of sftp communication from internal server not reaching www address.

Is the connection slow, are there timeouts ? In order to troubleshoot this, you would need access to the router. It might just be that the router (interface) is saturated.

[MHM Cisco World]

I dont know troubleshooting, but you can use capture in ASA, to see if the packet is reach or not the ASA. 

[MHM Cisco World]

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118097-configure-asa-00.html

this link for capture traffic in ASA

[jmaxwellUSAF]

The ASA LAN-interface-in ACL registers permit hits for this circuit.

There is no ACL on the outside interface.

Thus, is it still possible that traffic is not leaving this ASA for this circuit?

[MHM Cisco World]

share 
show local-host x.x.x.x <<- x.x.x.x is the IP address of destination 

[jmaxwellUSAF]

5525ASA# show local-host 2.2.2.2

Interface ONE: 1 active, 7 maximum active, 0 denied
Interface TWO: 1 active, 1 maximum active, 0 denied
Interface management: 0 active, 0 maximum active, 0 denied
Interface dmz: 24 active, 257 maximum active, 0 denied
Interface Inside: 378 active, 133543 maximum active, 0 denied
Interface Outside: 1798 active, 41512 maximum active, 0 denied
Interface FAILOVER: 1 active, 1 maximum active, 0 denied
Interface EIGHT: 0 active, 2 maximum active, 0 denied
Interface any: 0 active, 0 maximum active, 0 denied

[MHM Cisco World]

5525ASA# show local-host 2.2.2.2 detail <<- please share the output after add detail 

[jmaxwellUSAF]

"5525ASA# show local-host 2.2.2.2 detail <<- please share the output after add detail "

-output is identical to 5525ASA# show local-host 2.2.2.2

[jmaxwellUSAF]

The only device left is an 4431 ISR between the ASA and the www.

4431#sh run | inc access-gr
4431#sh run | inc access gr
4431#

... tells me there are no ACLs on the interfaces. Yes there are ACLs on the device. I don't know what they map to.

What is the next troubleshoot step here?

Thank you!

[MHM Cisco World]

there are two FW as I get from your previous comment 
one Zone Firewall <<- show policy-map type inpsect zone-pair <x-y>

one ASA <<- show local-host x.x.x.x detail (optional you can add connection keyword 
 show conn x.x.x.x <<- this give hint about tcp or udp traffic pass through ASA