Solved: Logs when ASDM access to ASA via Outside

mahesh18 · ‎06-15-2013

Hi Everyone,

I access the ASA via ASDM through the outside interface from PC connected to switch2.

ASA ----outside ---SW1---SW2---PC

ASDM is working fine.

After few mins i see these log messages

Jun 15 2013 19:46:35: %ASA-6-725007: SSL session with client outside:192.168.98.10/1769 terminated.

Jun 15 2013 19:46:35: %ASA-6-302014: Teardown TCP connection 1554 for outside:192.168.98.10/1769 to identity:192.168.11.2/443 duration 0:00:00 bytes 89416 TCP Reset-O

Jun 15 2013 19:46:35: %ASA-6-106015: Deny TCP (no connection) from 192.168.98.10/1769 to 192.168.11.2/443 flags FIN ACK on interface outside

Jun 15 2013 19:46:35: %ASA-7-710005: TCP request discarded from 192.168.98.10/1769 to outside:192.168.11.2/443

PC ----192.168.98.10

ASA outside interface -------------192.168.11.2

Are these messages normal?

Even though my connection to ASA via asdm never drops then why it says TCP Rest-O ???????

These messages appear again and again after some time in the logs.

Is repeating of these messages normal?

Regards

MAhesh

Jouni Forss · ‎06-16-2013

Hi Mahesh,

To my understanding these log messages are normal.

When I for example open ASDM connection to my ASA there are several TCP connections formed to the ASA and also several connections that are torn down or terminated.

I dont know for what the ASDM creates so many connections. I would imagine it loads some content from the ASA and then the connection is torn down.

The Reset-O I would imagine is a TCP Reset from your PC. The Deny TCP (no connection) message refers to the ASA getting messages from the PC to terminate the TCP connection but the ASA will drop them as the connection has been Reset before these messages. So there is no TCP connection to terminate. You can see this by looking at the source port of the TCP connection in the above log. The PC has already Resetted the TCP connection and then is also sending TCP FIN, ACK to the ASA.

- Jouni

View solution in original post

Jouni Forss · ‎06-16-2013

Hi Mahesh,

To my understanding these log messages are normal.

When I for example open ASDM connection to my ASA there are several TCP connections formed to the ASA and also several connections that are torn down or terminated.

I dont know for what the ASDM creates so many connections. I would imagine it loads some content from the ASA and then the connection is torn down.

The Reset-O I would imagine is a TCP Reset from your PC. The Deny TCP (no connection) message refers to the ASA getting messages from the PC to terminate the TCP connection but the ASA will drop them as the connection has been Reset before these messages. So there is no TCP connection to terminate. You can see this by looking at the source port of the TCP connection in the above log. The PC has already Resetted the TCP connection and then is also sending TCP FIN, ACK to the ASA.

- Jouni

mahesh18 · ‎06-16-2013

Hi Jouni,

Many thanks again.

Best regards

Mahesh