Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
New Member

ASA log message format

My ASA5540 sends syslog message to ASDM console in the following format:

6 Jul 09 2009 302013 20:54:13 81 10.48.17.16 10.11.16.2 59279 Built outbound TCP connection 9660652 for Outside:10.11.16.2/81 (10.11.16.2/81) to Inside:10.48.17.16/59279 (10.48.17.16/59279)

The connection is initiated from the inside host 10.48.17.16 to outside host 10.11.16.2. But the ip address 10.11.16.2 is in the source ip address column and 10.48.17.16 is in the destination ip address column.

Is it bug or feature?

1 ACCEPTED SOLUTION

Accepted Solutions

Re: ASA log message format

Hi Aliaksandr,

I agree the format is a little counter intuitive. These syslog messages always list the lower security interface first (outside in your case), followed by the higher security interface (inside in your case). This is always the case, regardless of the direction of the connection.

The inbound/outbound keyword is actually what denotes the direction of the connection, not the addresses themselves. So, since your message says "Built outbound", you know that the connection originated from the inside. If the message says "Built inbound", you know that the connection originated from the outside.

Hope that helps.

-Mike

3 REPLIES
New Member

Re: ASA log message format

I have added the Screenshot.

Re: ASA log message format

Hi Aliaksandr,

I agree the format is a little counter intuitive. These syslog messages always list the lower security interface first (outside in your case), followed by the higher security interface (inside in your case). This is always the case, regardless of the direction of the connection.

The inbound/outbound keyword is actually what denotes the direction of the connection, not the addresses themselves. So, since your message says "Built outbound", you know that the connection originated from the inside. If the message says "Built inbound", you know that the connection originated from the outside.

Hope that helps.

-Mike

New Member

Re: ASA log message format

Hi Michael,

Thank you for reply.

Best Regards.

162
Views
0
Helpful
3
Replies
CreatePlease to create content