cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

1988
Views
0
Helpful
7
Replies
fhk-cwempe
Beginner

ASA/Firepower get rid of "FELL OFF INPUT-rules" message

I just configured our new Firepower 1140 to use as a vpn server.

 

Everything works fine, but I get many of these syslog messages:

Mar 25 10:29:00 vpn.example.com :Mar 25 10:29:00 CET: %ASA-sys-4-199016: kernel: [79748.916832] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=38244 DPT=38244 LEN=9
Mar 25 10:29:00 vpn.example.com :Mar 25 10:29:00 CET: %ASA-sys-4-199016: kernel: [79748.916832] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=38244 DPT=38244 LEN=9
Mar 25 10:29:31 vpn.example.com :Mar 25 10:29:31 CET: %ASA-sys-4-199016: kernel: [79780.058272] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53009 DPT=53009 LEN=9
Mar 25 10:29:31 vpn.example.com :Mar 25 10:29:31 CET: %ASA-sys-4-199016: kernel: [79780.058272] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53009 DPT=53009 LEN=9
Mar 25 10:30:05 vpn.example.com :Mar 25 10:30:05 CET: %ASA-sys-4-199016: kernel: [79814.027971] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=60725 DPT=60725 LEN=9

 

Is this a problem?

How do I get rid of these messages?

 

I understand I could define "%ASA-sys-4-199016" to be ignored or tagged as "debug". 

But "%ASA-sys-4-199016" means "A variable syslog was generated by an assistive process" so it could have relevant information I guess.

7 REPLIES 7
Cristian Matei
VIP Collaborator

Hi,

    

     As everything works just fine, per your statements, these could be just some cosmetic messages, or could have to do with some management traffic not matching on rules. Try upgrading to the a recommended version and patch  level (like 6.4.0.7), see if you still get these messages. If yes, i would open a TAC case.

 

Regards,

Cristian Matei.

I am already on the latest update.

ASA: 9.13(1)7

 

I was hoping this is some kind of misconfiguration I could fix myself. :)

 

Will try a TAC if nobody else has an idea.

Sorry to revive a year old post but were you able to figure out what these were? I'm on 9.14(3) currently and am seeing these as well about every 30sec.

No. We are still clueless.

There is a listed bug in the Bug Search Tool for this. (Not that it actually has much useful information in it)

 

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt66186

 

It also says that the issue is fixed. Which doesn't seem to be true. We noticed that it was at least significantly less when traffic was passing through the device so it may be some kind of socket timing out due to nothing passing through it.

It doien not list a Known Fixed Release für 9.x.

Only 82.x and 2.x.

So that leaves some hope for a future 9.x release to fix this issue.

Create
Recognize Your Peers
Content for Community-Ad