Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

PIX 609001/609002 messages?

Hi: I can't seem to figure out what these two messages (609001 and 609002) from a PIX firewall mean. Can someone help.

======================

Message: %PIX-6-609001: Built local-host interface_name:IP_address

Explanation: A network state container is reserved for host IP_address connected to interface interface_name. This is an informational message.

Message: %PIX-6-609002: Teardown local-host interface_name:IP_address duration

time

Explanation: A network state container for host IP_address connected to interface interface_name is removed. This is an informational message.

==================

What does a network state container mean? and What does the duration at the end of 609002 mean?

TIA

Ravi

3 REPLIES
Silver

Re: PIX 609001/609002 messages?

This message is logged when the firewall discards a packet with an invalid source address. Invalid source addresses are those addresses belonging to the following:

o Loopback network (127.0.0.0)

o Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)

o The destination host (land.c)

Furthermore, if the sysopt connection enforcesubnet command is enabled, PIX Firewall discards packets with a source address belonging to the destination subnet from traversing the firewall andlogs this message.

Re: PIX 609001/609002 messages?

When the connection is permitted by the access-list then a build-up message apperars in the Log which indicates that a new connection was build. = PIX-6-609001

When the connection is closed you will see the teardown message = PIX-6-609002

Reference:

http://www.cisco.com/univercd/cc/td/doc/product/iaabu/pix/pix_sw/v_63/63syslog/pixemsgs.htm

sincerely

Patrick

Community Member

Re: PIX 609001/609002 messages?

Yesterday I started receiving a lot of these messages in the afternoon on my firewall. I was averaging about ~20 per minute but then it shot up to ~160 and stayed that way until sometime early this morning. My firewall sent off about 5 million logs in just these messages over the course of about 8 hours. Looking at the log messages, I dont yet see a correlation with the ip addresses its building and tearing down. Does anyone have an idea of what could cause this?

1654
Views
0
Helpful
3
Replies
CreatePlease to create content