ASA log message format

[APatotski]

My ASA5540 sends syslog message to ASDM console in the following format:

6 Jul 09 2009 302013 20:54:13 81 10.48.17.16 10.11.16.2 59279 Built outbound TCP connection 9660652 for Outside:10.11.16.2/81 (10.11.16.2/81) to Inside:10.48.17.16/59279 (10.48.17.16/59279)

The connection is initiated from the inside host 10.48.17.16 to outside host 10.11.16.2. But the ip address 10.11.16.2 is in the source ip address column and 10.48.17.16 is in the destination ip address column.

Is it bug or feature?

[APatotski]

I have added the Screenshot.

[robertson.michael · Accepted solution]

Hi Aliaksandr,

I agree the format is a little counter intuitive. These syslog messages always list the lower security interface first (outside in your case), followed by the higher security interface (inside in your case). This is always the case, regardless of the direction of the connection.

The inbound/outbound keyword is actually what denotes the direction of the connection, not the addresses themselves. So, since your message says "Built outbound", you know that the connection originated from the inside. If the message says "Built inbound", you know that the connection originated from the outside.

Hope that helps.

-Mike

[APatotski]

Hi Michael,

Thank you for reply.

Best Regards.