PIX-4-402106 Syslog Messages

[ccaron]

I get a few of these each day, and the src_addresses are not addresses on any of my networks.

%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= <my firewall IP>, src_addr= <someone elses IP>, prot= tcp

Does anyone have any thoughts on this, should I be concerned that this is a malicious attack? I would like to know if there is anything else I should be looking for.

-Chris

[steve.barlow]

The received packet matched your crypto map ACL, but is not IPSEC-encapsulated. As a result the packet is dropped. Take a look at your crypto map acls (both ends), it may be too general and "normal" unencrypted traffic is matching it.

Or it could be someone trying to hack in, feable attempt though as the packet isn't even encrypted.

First step is look carefully at your crypto map and see why it it matching (when you don't want it to). Then change your acl if needed.

If the acl is exactly as you want, and as specific as possible (to avoid cases like this), then we can track the IP down (with the aid of your ISP).

If you need help looking at your acl, please feel free to post it.

Hope it helps.

Steve