We've deployed two pixes in a failover configuration and placed them in front of a farm of webservers. The servers generate some 20 Mbit of traffic at peak times, many different sites are hosted in this webfarm.
Pretty much all traffic that is allowed to go the farm of servers is port 80 traffic, with a number of exceptions. This works well.
Ever since the installation, we're seeing - a lot of - log messages like the following in our syslog (anonymized for privacy of end users):
Jun 4 13:01:16 inside.fw1.xxxxxxxx.net %PIX-4-106023: Deny udp src outside:xxx.xxx.95.103/137 dst inside:xxx/137 by access-group "acl-outside"
Jun 4 13:01:17 inside.fw1.xxxxxxxx.net %PIX-4-106023: Deny udp src outside:xxx.xxx.107.104/137 dst inside:xxx/137 by access-group "acl-outside"
We see approximately 3 of these messages every five seconds from totally random sources and we have seen them since months and months.
Obviously it is 'a good thing'(tm) that the PIXes are blocking this traffic. I'm still not too sure what is causing these messages. Possibly some webbrowser implementations send a netbios packet before opening a http connection or so... It would be nice if someone could comment on the cause.
Next question, is it possible to not log specific types of denied traffic ??
Many thanks for your help.
Frans
