ASA Syslog Event 106001

Unanswered Question
Oct 8th, 2007

I'm seeing a lot of events in our ASA logs for 106001 relating to external source TCP (port 80) connections being denied inbound to our PAT address. The sources are all valid web sites which users are accessing. If a source inside connects to a website outside, surely the return traffic will be permitted without needing any extra ACLs?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
didyap Fri, 10/12/2007 - 09:55

This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. Indeed that means the conn table removed the connection. Such kind of messages are usually generated due to bad server kernel implementation.

jason.scott Sun, 10/14/2007 - 23:14

So the websites generating these messages are at fault rather than anything wrong with our configuration or something malicious?


This Discussion