Re: ASA/Firepower get rid of "FELL OFF INPUT-rules" message

fhk-cwempe · ‎03-25-2020

I just configured our new Firepower 1140 to use as a vpn server.

Everything works fine, but I get many of these syslog messages:

Mar 25 10:29:00 vpn.example.com :Mar 25 10:29:00 CET: %ASA-sys-4-199016: kernel: [79748.916832] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=38244 DPT=38244 LEN=9
Mar 25 10:29:00 vpn.example.com :Mar 25 10:29:00 CET: %ASA-sys-4-199016: kernel: [79748.916832] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=38244 DPT=38244 LEN=9
Mar 25 10:29:31 vpn.example.com :Mar 25 10:29:31 CET: %ASA-sys-4-199016: kernel: [79780.058272] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53009 DPT=53009 LEN=9
Mar 25 10:29:31 vpn.example.com :Mar 25 10:29:31 CET: %ASA-sys-4-199016: kernel: [79780.058272] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=53009 DPT=53009 LEN=9
Mar 25 10:30:05 vpn.example.com :Mar 25 10:30:05 CET: %ASA-sys-4-199016: kernel: [79814.027971] FELL OFF INPUT-rules: IN=lo OUT= MAC=00:00:00:00:00:00:00:00:00:00:00:00:86:dd src=0000:0000:0000:0000:0000:0000:0000:0001 DST=0000:0000:0000:0000:0000:0000:0000:0001 LEN=49 TC=46 HOPLIMIT=64 FLOWLBL=0 PROTO=UDP SPT=60725 DPT=60725 LEN=9

Is this a problem?

How do I get rid of these messages?

I understand I could define "%ASA-sys-4-199016" to be ignored or tagged as "debug".

But "%ASA-sys-4-199016" means "A variable syslog was generated by an assistive process" so it could have relevant information I guess.

Cristian Matei · ‎03-25-2020

Hi,

As everything works just fine, per your statements, these could be just some cosmetic messages, or could have to do with some management traffic not matching on rules. Try upgrading to the a recommended version and patch level (like 6.4.0.7), see if you still get these messages. If yes, i would open a TAC case.

Regards,

Cristian Matei.

fhk-cwempe · ‎03-25-2020

I am already on the latest update.

ASA: 9.13(1)7

I was hoping this is some kind of misconfiguration I could fix myself. :)

Will try a TAC if nobody else has an idea.

WilliamHamilton02800 · ‎05-03-2021

Sorry to revive a year old post but were you able to figure out what these were? I'm on 9.14(3) currently and am seeing these as well about every 30sec.

fhk-cwempe · ‎05-04-2021

No. We are still clueless.

claritas_solutions.com · ‎05-14-2021

There is a listed bug in the Bug Search Tool for this. (Not that it actually has much useful information in it)

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvt66186

WilliamHamilton02800 · ‎05-14-2021

It also says that the issue is fixed. Which doesn't seem to be true. We noticed that it was at least significantly less when traffic was passing through the device so it may be some kind of socket timing out due to nothing passing through it.

fhk-cwempe · ‎05-14-2021

It doien not list a Known Fixed Release für 9.x.

Only 82.x and 2.x.

So that leaves some hope for a future 9.x release to fix this issue.