PIX firewall decode message

[jimmyjoseph]

Hi,

I see the following message repeated in the firewall log.

PIX-3-305006: regular translation creation failed for udp src inside:169.254.69.1/138 dst DMZ:192.168.100.12/138

192.168.100.12 is a host in my DMZ where as the address 169.254.69.1 is no where in my inside network. This network is not published in the internet also.

Anybody has any thoughts on why such a behaviour would be observer?

ALso how do i identify a meesage to be an alert or an emrgency or a warning from the error code?

regards,

jimmy

[jimmyjoseph]

HI,

ok..i just found out that the sorce network is a network reserved for Windows DHCP..so its ok..tyhanks every one..

But how do i understand from the error code about the level of the message whether it s level 0, 1 ,2 ..

regards,

jimmy.

[mnlatif]

I think that

For a message format %PIX-Z-101001, "Z" is the priority making it Critical, Informational etc.

Also take a look at

http://www.cisco.com/en/US/customer/products/sw/secursw/ps2120/products_system_message_guide_chapter09186a0080089b20.html

[jimmyjoseph]

Hi,

Thanks for your information. Is there any freeware available which can check a unix based syslog for a particular message and perform an action like sending an e-mail to the administartor?

regards,

jimmy.

[kdurrett]

Jimmy,

I do believe that 169.x.x.x address is a pc's default address from microsoft when its set for dhcp and it doesn't get an address assigned to it. So you probably got a pc on your inside thats set to dhcp and hasnt gotten an address.

Kurtis