Err code : 106021

SANTHOSHKUMAR SARAVANAN · ‎11-09-2009

hi all

I am getting error code message (106021)generating about 1GB of logg message daily on my firewall to my sylog server , the address in this error message is invalid source address which is not configured are connected to my internal lan of pix firewall. i have network of 172.16.x.x but my error message comes in range of 10.0.0.1 .

Oct 09 2009 08:36:54: %PIX-1-106021: Deny UDP reverse path check from 172.21.19.

201 to 128.9.0.107 on interface inside

Oct 09 2009 08:36:54: %PIX-1-106021: Deny UDP reverse path check from 172.21.19.

201 to 192.33.4.12 on interface inside

Oct 09 2009 08:36:58: %PIX-1-106021: Deny UDP reverse path check from 172.21.19.

201 to 128.8.10.90 on interface inside

Oct 09 2009 08:36:58: %PIX-1-106021: Deny UDP reverse path check from 172.21.19.

201 to 192.203.230.10 on interface inside

Oct 09 2009 08:37:01: %PIX-1-106021: Deny UDP reverse path check from 172.21.18.

92 to 10.0.0.1 on interface inside

Oct 09 2009 08:37:02: %PIX-1-106021: Deny UDP reverse path check from 172.21.18.

92 to 10.0.0.1 on interface inside

kindly let me know wht to be done to reduce logg message to be generated

Herbert Baerten · ‎11-10-2009

Deny ... reverse path check means that the Pix is receiving packets from an address for which the Pix has a route that points to a different interface.

In each of the examples you give, the source is 172.21.x.x, so the Pix is receiving packets from 172.21.x.x on the inside interface but it does not have a route to these addresses towards the inside interface.

So either you should add a route (if these are legitimate addresses) or find out who/what is sending these packets.

BTW if you just want to stop the messages from being logged you can configure:

no logging message 106021

Or better is to rate-limit it, e.g.

logging rate-limit 1 60 message 106021

This will reduce the amount of 106021 messages to 1 per 60 seconds.

hth

herbert