Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

PIX-4-402106 Syslog Messages

I get a few of these each day, and the src_addresses are not addresses on any of my networks.

%PIX-4-402106: Rec'd packet not an IPSEC packet. (ip) dest_addr= <my firewall IP>, src_addr= <someone elses IP>, prot= tcp

Does anyone have any thoughts on this, should I be concerned that this is a malicious attack? I would like to know if there is anything else I should be looking for.

-Chris

1 REPLY

Re: PIX-4-402106 Syslog Messages

The received packet matched your crypto map ACL, but is not IPSEC-encapsulated. As a result the packet is dropped. Take a look at your crypto map acls (both ends), it may be too general and "normal" unencrypted traffic is matching it.

Or it could be someone trying to hack in, feable attempt though as the packet isn't even encrypted.

First step is look carefully at your crypto map and see why it it matching (when you don't want it to). Then change your acl if needed.

If the acl is exactly as you want, and as specific as possible (to avoid cases like this), then we can track the IP down (with the aid of your ISP).

If you need help looking at your acl, please feel free to post it.

Hope it helps.

Steve

229
Views
0
Helpful
1
Replies
CreatePlease login to create content