04-13-2011 10:59 AM - edited 03-11-2019 01:20 PM
Hi Folks
I Used the the packet tracer command line interface, i have seen the below line,what is mean?
Drop-reason: (sp-security-failed) Slowpath security checks failed
04-13-2011 11:42 AM
Hi Ibrahim,
The sp-security-failed reason is a bit of a catch-all, but here are the reasons why a packet might be dropped for this reason (from the command reference for 'show asp drop'):
http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/s2.html#wp1471978
Name: sp-security-failed
Slowpath security checks failed:
This counter is incremented and packet is dropped when the security appliance is:
1) In routed mode receives a through-the-box:
- L2 broadcast packet
- IPv4 packet with destination IP address equal to 0.0.0.0
- IPv4 packet with source IP address equal to 0.0.0.0
2) In routed or transparent mode and receives a through-the-box IPv4 packet with:
- first octet of the source IP address equal to zero
- source IP address equal to the loopback IP address
- network part of source IP address equal to all 0's
- network part of the source IP address equal to all 1's
- source IP address host part equal to all 0's or all 1's
3) In routed or transparent mode and receives an IPv4 or IPv6 packet with same source
and destination IP addresses
Recommendation:1 and 2) Determine if an external user is trying to compromise the protected network.
Check for misconfigured clients.3) If this message counter is incrementing rapidly, an attack may be in progress. Use
the packet capture feature to capture type asp packets, and check the source MAC address
in the packet to see where they are coming from.
Syslogs:1 and 2) 106016
3) 106017
Hope that helps.
-Mike
04-14-2011 11:46 AM
thanks mike,why the asa deak with syslog as codes like below
106016
3) 106017
04-14-2011 12:12 PM
Hi Ibrahim,
Here are the explanations for those syslog IDs:
106016
http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4768961
106017
http://www.cisco.com/en/US/docs/security/asa/asa84/system/message/logmsgs.html#wp4768976
-Mike
04-14-2011 12:31 PM
thanks mike
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide