The PIX 500 Series Firewall with version 7.x / ASA displays the %ASA-6-109025: Authorization denied (acl=limited_access) for user 'unknown' from x.x.x.x /xxx to x.x.x.x / x on interface outside using ICMP syslogs when the packets are denied by the vpn-fi

[TCC_2]

Core issue

This problem occurs when a vpn-filter command is defined under the group-policy, and packets are denied by the Access Control List (ACL).

This issue is documented in Cisco bug ID CSCsc79110.

Resolution

As a workaround, download and upgrade the software to any of these versions:

• 7.3(0.1)
  
  
• 7.2(0.40)
  
  
• 7.2(0.48)
  
  
• 7.0(4.11)
  
  
• 7.1(2.1)