Teardown missing for built inbound connection on Cisco PIX 6.3

Unanswered Question
May 8th, 2012

Hi,

In my syslog server configured for Cisco PIX 6.3,

I see lot of Built and teardown connections.

Logic says if something is built then there should be a teardown.

But I do not see teardowns for some connections even though I know that path is already broken long time ago.

See below.

May  3 09:44:16 ::ffff:204.50.68.253 May 03 2012 12:50:32 cfwprd1a : %PIX-6-302013: Built inbound TCP connection 954594374 for dcn:10.199.58.15/33646 (10.199.58.15/33646) to dmz:172.16.169.238/443 (204.50.68.235/443)

Why is there no teardown for the above in my syslog server?

And this is not just one - there are many meesages that do not have teardowns.

Thanks

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Average Rating: 0 (0 ratings)
varrao Tue, 05/08/2012 - 11:39

Hi Kunal,

Check the following, I guess you migth have this message diasable, check:

show run logging

if it is:

no logging message 302014

then apply:

logging message 302014

I guess you might have this log suppressed on the ASA.

Thanks,

Varun

Security Team,
Cisco TAC

kunal-united Wed, 05/09/2012 - 04:10

Hi,

Please check this.

logging on

logging timestamp

logging standby

logging monitor debugging

logging buffered warnings

logging trap informational

logging history critical

logging device-id hostname

logging host dcn 204.50.69.3

logging host dcn 204.50.69.228

logging host apps 10.10.192.82

no logging message 106023

Thanks

varrao Wed, 05/09/2012 - 07:19

Hi Kunal,

Can you filter your syslog server for the connection ID 954594374?? Moreover, are you able to see the Teardown in the ASDM log viewers, and the ASA log buffer? Can you also share the output of "show logging-queue"??

Thanks,
Varun Rao
Security Team,
Cisco TAC

kunal-united Wed, 05/09/2012 - 08:19

# sh logging queue

        Logging Queue length limit : 512 msg(s), 6251808 msg(s) discarded.

        Current 16 msg on queue, 512 msgs most on queue

I have all logs on the syslog server.

And I cannot see teardowns for few connections that were built.

Thanks

Actions

Login or Register to take actions

This Discussion

Posted May 8, 2012 at 10:36 AM
Stats:
Replies:4 Avg. Rating:
Views:387 Votes:0
Shares:0
Tags: No tags.

Discussions Leaderboard

Rank Username Points
1 7,861
2 6,140
3 3,170
4 1,473
5 1,446