What is ASA Error message "Through-the-device packet to/from nve-only network is denied"?

[pematthe]

I have an ASA which, for one subnet only, will not pass traffic.  Configuration is consistent between a number of working interfaces with only the IP network and VLAN being different.  Same physical interface with only sub-interfaces and IP ranges being different.

When tracing the client I receive this error message:

781001    Through-the-device packet to/from nve-only network is denied: udp src IOT_DEVICES:x.x.x.x/55465 dst outside:8.8.8.8/53

I cannot find any reference of Syslog error 781001 or what the nve-only interface is.

FYI - ASA 5516, OS - 9.6(1) with firepower v6.1 but no traffic passed through the module.  

[pematthe]

I fixed my problem but would still like to know what the syslog message means.

I fixed it by deleting and then re-entering the interface configuration.  Same config!  Must have been a glitch in the ASA.  

[Marvin Rhoads]

It does sound like a bug.

An nve is a network virtualzalization interface (i.e. VXLAN Tunnel Endpoint). Did somebody  possibly configure and then unconfigure XLAN on the interface at one point?

http://www.cisco.com/c/en/us/td/docs/security/asa/asa94/config-guides/cli/general/asa-94-general-config/interface-vxlan.html

[roberthillcoat]

I had the exact same error, the NVE interface is related to the VTEP configuration on the physical interface. 

If you uncheck the VTEP source interface box under the interface configuration you will resolve the issue. 

[netwerk@is.nl]

Same packet here in the log:

Through-the-device packet to/from management-only network is denied: icmp src management:10.x.y.5 dst management:10.c.d.221

Reason:
We had two different devices (firewalls) both using contexts. On both of the management interfaces on the contexts, the management interfaces had exáctly the same mac address.
Chances maybe one in a million, but it happened....
Causing packets to be send to the management interface of the other context (10.c.d.221)

Solution:
Remove the management interface, and rebuild interface including it's configuration, et voila.

[kosmic]

Just ran into this exact issue tonight.  Someone on my team recently enabled "mac-address auto."  That coupled with a power outage, and we were seeing this error log and the MACs being the same.  Only 1 IP would be reachable, and typically it was the IP of the slave unit.  This fix worked for us, thanks.

Note: if you delete the interface, all associated config such as AAA and traps will also be removed.  Make sure to get a plaintext backup of the config before.