cancel
Showing results for 
Search instead for 
Did you mean: 
cancel

Who Me Too'd this topic

How to read firewall log files

manojkulk
Level 1
Level 1

2 duration 0:03:04

<166>:%ASA-session-6-302014: Teardown TCP connection 2756946 for YOUB:184.31.212.174/80 to inside:10.10.10.1009/49945 duration 0:00:12 bytes 0 TCP FINs

<166>:%ASA-session-6-302014: Teardown TCP connection 2756947 for YOUB:184.31.212.174/80 to inside:10.10.10.1009/49946 duration 0:00:12 bytes 0 TCP FINs

<167>:%ASA-session-7-609002: Teardown local-host YOUB:184.31.212.174 duration 0:00:12

<167>:%ASA-session-7-609001: Built local-host inside:10.10.10.10

<166>:%ASA-session-6-302013: Built outbound TCP connection 2756977 for inside:10.10.10.10/21 (10.10.10.10/21) to identity:10.10.10.10/50476 (10.10.10.10/50476)

<163>:%ASA-sys-3-414001: Failed to save logging buffer to FTP server 10.10.10.10 using filename LOG-2014-02-13-190303.TXT on interface inside: [Device open error]

<166>:%ASA-session-6-302014: Teardown TCP connection 2756943 for YOUB:46.51.219.164/80 to inside:10.10.10.1009/49943 duration 0:00:12 bytes 0 TCP FINs

<166>:%ASA-session-6-302014: Teardown TCP connection 2756944 for YOUB:46.51.219.164/80 to inside:10.10.10.1009/49944 duration 0:00:12 bytes 0 TCP FINs

<166>:%ASA-session-6-302014: Teardown TCP connection 2756949 for YOUB:174.129.247.121/80 to inside:10.10.10.1009/49947 duration 0:00:12 bytes 0 TCP FINs

<166>:%ASA-session-6-302014: Teardown TCP connection 2756179 for YOUB:50.97.236.98/80 to inside:10.10.10.1009/49692 duration 0:02:23 bytes 8416 TCP FINs

<167>:%ASA-session-7-609002: Teardown local-host YOUB:50.97.236.98 duration 0:02:23

<166>:%ASA-session-6-302014: Teardown TCP connection 2756950 for YOUB:174.129.247.121/80 to inside:10.10.10.1009/49948 duration 0:00:12 bytes 0 TCP FINs

<161>:%ASA-session-1-106021: Deny UDP reverse path check from Testpdf to 10.10.10.10 on interface YOUB

<167>:%ASA-session-7-710005: UDP request discarded from Testpdf/137 to inside:10.10.10.10/137

<161>:%ASA-session-1-106021: Deny UDP reverse path check from Testpdf to 10.10.10.10 on interface YOUB

<167>:%ASA-session-7-710005: UDP request discarded from Testpdf/138 to inside:10.10.10.10/138

<166>:%ASA-session-6-302014: Teardown TCP connection 2756977 for inside:10.10.10.10/21 to identity:10.10.10.10/50476 duration 0:00:00 bytes 0 TCP Reset-O

<167>:%ASA-session-7-609002: Teardown local-host inside:10.10.10.10 duration 0:00:00

<166>:%ASA-session-6-302014: Teardown TCP connection 2754536 for YOUB:74.125.236.65/443 to inside:10.10.10.1046/49751 duration 0:10:05 bytes 187079 TCP FINs

<166>:%ASA-session-6-302013: Built inbound TCP connection 2756978 for inside:FinalPdf/3893 (FinalPdf/3893) to identity:10.10.10.10/443 (10.10.10.10/443)

<166>:%ASA-ssl-6-725001: Starting SSL handshake with client inside:FinalPdf/3893 for TLSv1 session.

<166>:%ASA-ssl-6-725003: SSL client inside:FinalPdf/3893 request to resume previous session.

<166>:%ASA-ssl-6-725002: Device completed SSL handshake with client inside:FinalPdf/3893

<165>:%ASA-config-5-111007: Begin configuration: FinalPdf reading from http [POST]

<165>:%ASA-config-5-111008: User 'cisco' executed the 'logging ftp-server 10.10.10.10 firwall/ vml vml' command.

<166>:%ASA-session-6-302014: Teardown TCP connection 2756978 for inside:FinalPdf/3893 to identity:10.10.10.10/443 duration 0:00:00 bytes 255 TCP Reset-O

<166>:%ASA-session-6-106015: Deny TCP (no connection) from FinalPdf/3893 to 10.10.10.10/443 flags FIN ACK  on interface inside

<167>:%ASA-session-7-710005: TCP request discarded from FinalPdf/3893 to inside:10.10.10.10/443

<166>:%ASA-ssl-6-725007: SSL session with client inside:FinalPdf/3893 terminated.

<166>:%ASA-session-6-305011: Built dynamic TCP translation from inside:10.10.10.1010/50758 to YOUB:10.10.10.10/38671

<166>:%ASA-session-6-302013: Built outbound TCP connection 2756979 for YOUB:65.182.162.190/80 (65.182.162.190/80) to inside:10.10.10.1010/50758 (10.10.10.10/38671)

<166>:%ASA-session-6-305012: Teardown dynamic TCP translation from inside:192.168.2.37/52012 to YOUB:10.10.10.10/52872 duration 0:02:00

<166>:%ASA-session-6-305011: Built dynamic TCP translation from inside:10.10.10.1010/50759 to YOUB:10.10.10.10/49081

Who Me Too'd this topic