Case 1: ":Feb 25 16:42:16 EST: %ASA-session-4-500004: Invalid transport field for protocol=TCP, from {Black listed IP}/{random source port} to {public server}/0 "
Case 2: ":Feb 25 16:42:16 EST: %ASA-session-4-500004: Invalid transport field for protocol=TCP, from {Internal IP}/{random source port} to {public server}/0 "
In case I am able to see 1000-2000 events within 2 to 5 sec and at the same time case 2 events triggering. Could you help me in understanding are the packets allowed into network or not? If not what is action taken by ASA?How to avoid or mitigate this in future?
