06-14-2012 12:34 PM - edited 03-11-2019 04:19 PM
Ok, I can't for the life of my figure out why internal syslog traffic would be dropped at the firewall. I've come across a few support forums with comments like 'disable the specific syslog error, etc.' however this does not fix my problem. I need the syslog messages from my Citrix VM Servers to reach the syslog server and the firewall is dropping them for some reason:
The syslog error that gets logged:
%ASA-2-106006: Deny inbound UDP from 192.168.1.200/514 to 192.168.1.210/514 on interface inside
Here is my current lab setup:
ubuntu (VM) --> XenServer --> ASA 5505
(192.168.1.201) (192.168.1.200) (192.168.1.1)
I have tons of hits on rule #2, none on rule #1 for my inside interface access list:
1. access-list inside_access_in extended permit udp any any eq syslog log notifications (put this one in for test... doesn't get any hits)
2. access-list inside_access_in extended permit ip any any log (this is the rule that should allow all internal traffic, right?)
This is the output from 'show logging'
Syslog logging: enabled
Facility: 16
Timestamp logging: enabled
Standby logging: disabled
Debug-trace logging: disabled
Console logging: disabled
Monitor logging: disabled
Buffer logging: disabled
Trap logging: level critical, facility 16, 970565 messages logged
Logging to inside 192.168.1.210 errors: 70 dropped: 1162
Permit-hostdown logging: disabled
History logging: disabled
Device ID: hostname "asa1"
Mail logging: disabled
ASDM logging: level warnings, 4035521 messages logged
Thanks!
06-18-2012 02:37 PM
Well, all these VM, XenServer and ASA are on the same subnet right? Mask is /24?
If so, why are the packets going between 1.200 to 1.210 going to the ASA?
If these are on different subnet then the topology should look like this:
VM---ASA---Syslog_Server
And, you need to provide translation for the VM host.
static (inside,outside) VM_IP VM_IP
-Kureli
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide