ASA generating 106001 syslog iD

rdodderi · ‎08-05-2009

Hi,

I can see huge syslog generation with syslog ID 106001 and also random users across my network are facing Messenger's disconnection and reconnection.

Collin Clark · ‎08-05-2009

Here's an explaination.

http://www.cisco.com/en/US/docs/security/asa/asa72/system/message/logmsgs.html#wp1279735

handsy · ‎08-05-2009

More info required. Please paste an example log entry, and also the access-list entries that the users should be hitting for Messenger.

rdodderi · ‎08-05-2009

Hi Handsy,

Please find the sample Log entry and access-list. On the log file the IP's which you see some of them are valid Yahoo,MSN, and Google Chat server IP's and some does not get resolved to any.

Kindly let me know if you need more info from my side.

Thanks

Rajiv

handsy · ‎08-06-2009

I think the key to this problem is that an IP from inside your network, namely 220.x.x.123 is getting blocked on it's return, i.e. it's allowed out, but not back in.

Do you have an ACL entry to allow HTTP access to this IP? (I can't tell as you have xxxx'ed them out).