12 entries
Cisco ASA
Firewall syslog messages — denies, permits, and connection records.
- 106001 Cisco ASA 106001: Inbound TCP connection denied Informational The firewall dropped an inbound TCP packet, either because no rule allowed it or because the packet did not belong to any established connection. Its severity 2 rating makes it look urgent in a log viewer; on an internet-facing interface it is routine.
- 106023 Cisco ASA 106023: Traffic denied by an access-list Informational The firewall dropped a packet because no rule allowed it. This is the firewall doing its job, and on an internet-facing device it fires constantly. It only matters when the traffic was supposed to work, or when the pattern looks like scanning.
- 106100 Cisco ASA 106100: An access-list rule matched Informational A rule with logging enabled matched a packet, and the firewall recorded whether it permitted or denied it. Unlike the deny-only messages, this one shows permits too, which makes it the message to use when confirming a rule actually works.
- 111008 ASA 111008: An administrator ran a command on the firewall Worth a look The ASA recorded a command someone typed. This is your configuration change audit trail — and it is also where you find out that somebody turned logging off, because the command that does it is itself recorded here, right before the silence.
- 113005 Cisco ASA 113005: VPN authentication was rejected Worth a look Someone tried to authenticate to the firewall, usually for VPN access, and the authentication server refused. On any internet-facing VPN these arrive constantly — and the ones that matter are the ones followed by a success.
- 302013 Cisco ASA 302013: A TCP connection was built Informational The firewall allowed a TCP connection and started tracking it. This is what a successful, permitted flow looks like, and it is the message you check to confirm that a rule change actually worked.
- 302014 Cisco ASA 302014: A TCP connection was torn down Informational A connection ended, and the firewall recorded how long it lasted, how many bytes moved, and why it closed. The byte count is the field that matters — it is the ASA's closest equivalent to flow data, and it is how you spot data leaving.
- 302016 ASA 302016: A UDP conversation timed out Informational UDP has no connections, so the firewall invents one and closes it when nothing has been heard for a while. That means the duration in this message measures the firewall's idle timer, not the conversation — and it is why DNS alone can account for most of the lines in an ASA log.
- 305011 Cisco ASA 305011: A NAT translation was created Informational The firewall assigned an internal address and port a public one. This is the message that lets you answer 'which internal machine was 203.0.113.10 port 45392 at 14:07 last Tuesday' — the single question NAT otherwise makes unanswerable.
- 605005 ASA 605005: Someone logged in to manage the firewall Worth a look A management session on the firewall itself succeeded. On a device where a handful of people ever log in, this is one of the shortest and most useful log streams you have — small enough to read by hand, and important enough that every line should have a name you recognise.
- 710003 ASA 710003: Something tried to manage the firewall itself Investigate This is not a blocked connection through the firewall — it is a blocked connection to the firewall. Somebody aimed SSH, HTTPS, or SNMP at the ASA's own interface address and was refused because their address is not on the management allow-list.
- 733100 ASA 733100: A drop rate crossed a threat-detection threshold Worth a look Basic threat detection counts things the firewall drops and complains when the rate goes above a threshold. The thresholds are Cisco's defaults, not yours, so the first question is never 'what attacked us' — it is whether this threshold means anything in your environment.