6 entries
Cisco ASA
Firewall syslog messages — denies, permits, and connection records.
- 106001 Cisco ASA 106001: Inbound TCP connection denied Informational The firewall dropped an inbound TCP packet, either because no rule allowed it or because the packet did not belong to any established connection. Its severity 2 rating makes it look urgent in a log viewer; on an internet-facing interface it is routine.
- 106023 Cisco ASA 106023: Traffic denied by an access-list Informational The firewall dropped a packet because no rule allowed it. This is the firewall doing its job, and on an internet-facing device it fires constantly. It only matters when the traffic was supposed to work, or when the pattern looks like scanning.
- 106100 Cisco ASA 106100: An access-list rule matched Informational A rule with logging enabled matched a packet, and the firewall recorded whether it permitted or denied it. Unlike the deny-only messages, this one shows permits too, which makes it the message to use when confirming a rule actually works.
- 113005 Cisco ASA 113005: VPN authentication was rejected Worth a look Someone tried to authenticate to the firewall, usually for VPN access, and the authentication server refused. On any internet-facing VPN these arrive constantly — and the ones that matter are the ones followed by a success.
- 302013 Cisco ASA 302013: A TCP connection was built Informational The firewall allowed a TCP connection and started tracking it. This is what a successful, permitted flow looks like, and it is the message you check to confirm that a rule change actually worked.
- 302014 Cisco ASA 302014: A TCP connection was torn down Informational A connection ended, and the firewall recorded how long it lasted, how many bytes moved, and why it closed. The byte count is the field that matters — it is the ASA's closest equivalent to flow data, and it is how you spot data leaving.