Warning message from ASA

gandhi.ganesh · ‎04-20-2009

Hi,

I am continously getting the warning message from my ASA 5520. below is the logs from syslog server

10.5.5.3: My FW

10.5.5.21: remote server

192.168.103.38: my local m/c

2009-04-09 10:54:58 Local4.Warning 10.5.5.3 Apr 09 2009 09:52:59: %ASA-4-106023: Deny udp src app5:10.5.5.21/137 dst outside:192.168.103.38/137 by access-group "appX_in" [0x4861fb67, 0x0]

2009-04-09 10:54:58 Local4.Warning 10.5.5.3 Apr 09 2009 09:52:59: %ASA-4-106023: Deny udp src app5:10.5.1.25/137 dst outside:192.168.103.38/137 by access-group "appX_in" [0x4861fb67, 0x0]

2009-04-09 10:54:58 Local4.Warning 10.5.5.3 Apr 09 2009 09:52:59: %ASA-4-106023: Deny udp src app5:10.5.9.25/137 dst outside:192.168.103.38/137 by access-group "appX_in" [0x4861fb67, 0x0]

2009-04-09 10:54:58 Local4.Warning 10.5.5.3 Apr 09 2009 09:52:59: %ASA-4-106023: Deny udp src app5:10.5.4.25/137 dst outside:192.168.103.38/137 by access-group "appX_in" [0x4861fb67, 0x0]

vikram_anumukonda · ‎04-21-2009

well there is not much of information even on the documentation site

106023

Error Message %PIX|ASA-4-106023: Deny protocol src

[interface_name:source_address/source_port] dst

interface_name:dest_address/dest_port [type {string}, code {code}] by

access_group acl_ID

Explanation An IP packet was denied by the ACL. This message displays even if you do not have the log option enabled for an ACL.

Recommended Action If messages persist from the same source address, messages might indicate a foot-printing or port-scanning attempt. Contact the remote host administrators.

gandhi.ganesh · ‎04-21-2009

I am continously getting the message from these 4 src m/cs

What do you mean by Contact the remote host administrators ?

vikram_anumukonda · ‎04-21-2009

it was straight from documentation

http://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4769021