Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 
New Member

Firewall configuration assistance

I am seeing this message on my syslog server that I have NO explaination for. 
Perhap someone can point me to the right direction.


I have a site-to-site VPN between hostA and hostB between the ASA and the VPNc.
hostA is, ASAVPN inside interface is ASAVPN outside interface
is and the ASAFW internal interface is  here is the configuration on
the ASAFW, VPNc external ip address is

static (i,o) netmask
access-list FW-out permit icmp VPNc log
access-list FW-out permit udp VPNc eq 500 log
access-list FW-out permit udp VPNc eq 4500 log
access-list FW-out permit esp VPNc log
access-list FW-out deny ip any any log
access-group FW-out in interface outside

on the ASAVPN, this is what I have (relevant configuration):

no nat-control
icmp permit host outside
access-list vpn permit host host
isakmp identity address
isakmp nat-traversal 10
crypto isakmp enable
crypto map vpn 10 ipsec-isakmp
crypto map vpn 10 set peer VPNc
crypto map vpn 10 set trans 3des
crypto map vpn 10 set pfs group2
crypto map vpn 10 match address vpn
crypto map vpn interface outside

VPNc public interface:
VPNc Private interface:

ASA is running version 8.2.1

The site-2-site VPN between the VPNc and the ASAVPN is working fine.  However, I am getting this syslog
message from the ASAVPN on my syslog server:

ASAVPN Mar 25 2010 02:09:39: %ASA-3-313001: Denied
ICMP type=11, code=0 from on interface outside

How does this IP even make it to the ASAVPN device?

Cisco Employee

Re: Firewall configuration assistance

That appears to be ICMP time exceeded message.

May be someone from the inside was trying to do a traceroute to an ip address on the outside and the icmp time exceeded message arriving on the outside interface is being denied.  I am not sure if you have icmp and icmp error inspection enabled. In addition to that you need to allow icmp time exceeded and icmp unreachable on the outside interface.

To uderstand how traceroute works follow this link:


CreatePlease to create content