Deny inbound ICMP

[dianewalker]

We have ASA 5540, running IOS 8.2.(4).  For some reason, I kept getting email notification about this message  "<155>Feb 17 2011 04:59:16: %ASA-3-106014: Deny inbound icmp src Outside:74.125.24.179 dst Inside:74.125.20.1 (type 3, code 1)".  Sometimes, I get this email notification 3 times within 1 minute interval.  Do you have any suggestions what caused this type of error message and how to fix it?  No one was logging in to Cisco VPN client when this error occurred.

Thanks.

Diane

[Federico Coto Fajardo]

Diane,

Can you post a show run to check if there's a rule like that?

Federico.

[dianewalker]

Here is my show run config.  Thanks.

ciscoasa# show run
: Saved
:
ASA Version 8.2(4)
!
hostname ciscoasa
domain-name consoto.com
enable password Seicdieikui039 encrypted
passwd 83k9k39dweikdiikcw encrypted
names
dns-guard
!
interface GigabitEthernet0/0
speed 100
duplex full
nameif Outside
security-level 0
ip address 216.132.249.16 255.255.255.0
!
interface GigabitEthernet0/1
speed 100
duplex full
nameif Inside
security-level 100
ip address 216.132.251.16 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 216.132.252.18 255.255.255.0
management-only
!
interface GigabitEthernet1/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1
shutdown
no nameif   
no security-level
no ip address
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
boot system disk0:/asa824-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring 1 Sun Apr 2:00 last Sun Oct 2:00
dns server-group DefaultDNS
domain-name consoto.com
same-security-traffic permit intra-interface
access-list 101 extended permit icmp any any
access-list 101 extended permit ip any any
access-list nonat extended permit ip 216.132.0.0 255.255.0.0 172.27.80.0 255.255.255.0
access-list nonat extended permit ip 192.168.100.0 255.255.255.0 172.27.80.0

255.255.255.0
access-list split standard permit 216.132.250.0 255.255.255.0
access-list accounting standard permit host 216.132.250.10
access-list 109 extended permit icmp host 216.132.249.254 host 216.132.249.16
pager lines 10
logging enable
logging timestamp
logging list Events level errors class auth
logging list Events level errors class session
logging list Events level errors class sys
logging buffer-size 1048576
logging console errors
logging buffered debugging
logging trap informational
logging asdm informational
logging mail errors
logging from-address ciscoasa@consoto.com
logging recipient-address admin@consoto.com level errors
logging facility 19
mtu Outside 1500
mtu Inside 1500
mtu management 1500
ip local pool vpnpool 10.100.0.1-10.100.7.254 mask 255.255.248.0
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-635.bin
no asdm history enable
arp timeout 14400
nat-control
global (Outside) 1 interface
nat (Inside) 0 access-list nonat
nat (Inside) 1 0.0.0.0 0.0.0.0
access-group 109 in interface Outside control-plane
route Outside 0.0.0.0 0.0.0.0 216.132.249.254 1
route Inside 216.132.0.0 255.255.0.0 216.132.251.254 1
route Inside 192.168.100.0 255.255.255.0 216.132.251.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 216.132.252.250 255.255.255.255 Inside
http 0.0.0.0 0.0.0.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set vpn esp-3des esp-sha-hmac
crypto ipsec transform-set myset esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map DYNMAP 21 set transform-set vpn
crypto dynamic-map DYNMAP 21 set security-association lifetime seconds 28800
crypto dynamic-map DYNMAP 21 set security-association lifetime kilobytes 4608000
crypto map mymap 40 set security-association lifetime seconds 28800
crypto map mymap 40 set security-association lifetime kilobytes 4608000
crypto map mymap 65535 ipsec-isakmp dynamic DYNMAP
crypto map mymap interface Outside
crypto isakmp identity address
crypto isakmp enable Outside
crypto isakmp enable Inside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 20
authentication pre-share
encryption 3des
hash md5    
group 2
lifetime 86400
no crypto isakmp nat-traversal
group-delimiter @
telnet 0.0.0.0 0.0.0.0 management
telnet timeout 5
ssh 216.132.252.50 255.255.255.255 Inside
ssh 0.0.0.0 0.0.0.0 management
ssh timeout 5
ssh version 2
console timeout 0
management-access Inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy DfltGrpPolicy attributes
wins-server value 216.132.250.250
dns-server value 216.132.250.251
vpn-tunnel-protocol IPSec webvpn
webvpn
  svc keepalive none
  svc dpd-interval client none
  svc dpd-interval gateway none
  customization value DfltCustomization
group-policy accounting internal
group-policy accounting attributes
wins-server value 216.132.250.250
dns-server value 216.132.250.251
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value accounting
default-domain value consoto.com
split-dns none
username admin password yea6D174q9iHz encrypted privilege 15
username user1 password nIsrzp5Yw0RLu/4 encrypted
username user1 attributes
vpn-group-policy accounting
vpn-filter value accounting
vpn-tunnel-protocol IPSec
service-type remote-access
username billz password a43c0v8HqfSlKkgX0A encrypted privilege 15
tunnel-group accounting type remote-access
tunnel-group accounting general-attributes
address-pool vpnpool
default-group-policy accounting
password-management
strip-group
!            
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect icmp
  inspect ip-options
!
service-policy global_policy global
smtp-server 216.132.250.25
prompt hostname context
call-home    
profile CiscoTAC-1
  no active
  destination address http

https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:cda817935copeze262ad59c757664be
: end
ciscoasa# exit

[Federico Coto Fajardo]

Diane,

The ASA is configured to send logs via emails:

logging from-address ciscoasa@consoto.com

logging recipient-address admin@consoto.com level errors

What I don't understand is that you mentioned that 74.125.20.1 was the outside IP of the ASA and 74.125.24.179 your default

gateway, but according to the configuration you have a 216.132.249.16 IP instead.

Federico.

[dianewalker]

Sorry Federico.  Those are not real IP addresses.  I put them there as an example.

Thanks.

Diane

[Federico Coto Fajardo]

Ok,

I see this command:

access-group 109 in interface Outside control-plane

But ACL 109 does not exist.

Could you include it just to make sure that if you PING it works fine?

If the PING is succesful, you should not get that log anymore.

Federico.

[dianewalker]

Federico,

Is this what you want me to add?

access-list 109 extended permit icmp any any

Thanks.

Diane

[Federico Coto Fajardo]

Yes.
Please add it, then make sure the PING works, then check you don't receive the message anymore.

Federico.

[dianewalker]

Thanks Federico.

I added the access-list 109 and verified that PING is still working.  I will know if I still get email notifications or not in 20 minutes since I get email notifications every hour.  I will get back to you.

Thanks.

Diane

[dianewalker]

I got one email notification.  I usually got 3 or 4 duplicate email notifications.  Let's wait for another hour and see what happened.  I will get back to you.

Thanks.

Diane

[dianewalker]

I just got two email notifications.  Do you have any other suggestions?

Thanks.

Diane

[Federico Coto Fajardo · Accepted solution]

Ok, analizing the original message:

ICMP type 3, code 1 is Host Unreachable.

So, a remote router will normally reply with ICMP Type 3 code 1 when you
send a packet attempting to connect to a host that does not exist, or
exists but is turned off/disconnected. You need to review your outbound traffic, and find what host is sending
the original traffic to an unreachable host.

Most likely this is a response to an outbound packet (getting translated to the outside IP of the ASA).

Federico.