cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
324
Views
0
Helpful
1
Replies
Highlighted

AnyConnect users try to connect broadcast in the same network

Hello, I have strange situation 

 

My topology is:

 

Anyconnect User --> Asa+ACS (5.5)+AD --> inside Network

 

When User connecting to ASA by anyconnect client, i see  many many rows with strange logs:

4|Oct 27 2018 13:12:33|106103: access-list AAA-user-polinao-19667502 denied udp for user 'polinao' outside/10.XX.121.45(137) -> outside/10.XX.121.63(137) hit-cnt 1 first hit [0xea7e4b66, 0x0]

 

Where 10.xx.121.63 - broadcast address of network  for anyconnect clients - 10.xx.121.0/26

 

If someone faced a similar situation, please tell me what it can be connected with. Thanks

 

1 REPLY 1
Highlighted
Hall of Fame Guru

You have not given us much information to work with. But the most significant clue in what you have posted is that they are attempting access on UDP port 137 which is used for netBIOS. netBIOS frequently tries to identify resources by sending broadcast frames. It is apparent that the access list assigned for this user is not permitting those netBIOS broadcast requests.

 

HTH

 

Rick

HTH

Rick