deny TCP (no connection)

rsullivan1 · ‎02-13-2009

I see a lot of these messages, maybe hundreds per minutes. I feel this is not normal, but can never find any convincing information either way. Can anyone elaborate?

eddie.mitchell · ‎02-13-2009

Can you tell us what message ID is associated with what you're seeing?

http://www.cisco.com/en/US/docs/security/pix/pix63/system/message/pixemsgs.html

rsullivan1 · ‎02-13-2009

106015

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4768951

eddie.mitchell · ‎02-13-2009

Is this firewall on your network perimeter? Are all of these messages being generated from the same source IP address? Same destination IP? Same source or destination port?

rsullivan1 · ‎02-13-2009

This is our perimeter which then interfaces another LAN. Another firewall is used at the internet perimeter. The addresses are not the same, although you see a cluster of denies (between 2 and 6 for each deny). We had an explicit deny any any log entry at the end of the outside rules. I just disabled this and noticed a significant drop in the logged traffic. I'm not sure this is just a band-aid to the real issue though.