LogAnalysis
[logs] Information about Cisco ASA "Firewall Server" messages Feb 15 2008 01:48AM
Anusuya K (anusuya_k yahoo com)
Hi,
While analyzing the Cisco ASA 8.0 log messages I came across some VPN messages which refer to firewall server/Security appliance server. Following are some of them:

%PIX|ASA-7-713160: Remote user (session Id - id) has been granted access by the Firewall Server
%PIX|ASA-3-713161: Remote user (session Id - id) network access has been restricted by the Firewall Server
%PIX|ASA-3-713162: Remote user (session Id - id) has been rejected by the Firewall Server
%PIX|ASA-3-713163: Remote user (session Id - id) has been terminated by the Firewall Server

Description of these messages refers to "Security appliance server" and not firewall server. I am not able to figure out what is the meaning of either "firewall server" or "security appliance server". This does not look same as "firewall" or "security appliance". Searching on Cisco site also did not help.

Is anybody aware if this is a component of ASA/firewall itself or anything external, and when do these events occur in normal course of operartions in PIX/ASA (I did not find see these messages occuring in our test environment atleast). Any pointers would be appreciated.

Thanks
Anusuya

Looking for last minute shopping deals? Find them fast with Yahoo! Search.

________________________________________________________________________
____________
Never miss a thing. Make Yahoo your home page.
http://www.yahoo.com/r/hs<html><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>Hi,</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>  While analyzing the Cisco ASA 8.0 log messages I came across some VPN messages which refer to firewall server/Security appliance server. Following are some of them:</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>%PIX|ASA-7-713160: Remote user (session Id - id) has been granted access by the Firewall Server</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>%PIX|ASA-3-713161: Remote user (session Id - id) network access has been restricted by the Firewall Server</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>%PIX|ASA-3-713162: Remote user (session Id - id) has been rejected by the Firewall Server</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>%PIX|ASA-3-713163: Remote user (session Id - id) has been terminated by the Firewall Server</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>Description of these messages refers to "Security appliance server" and not firewall server. I am not able to figure out what is the meaning of either "firewall server" or "security appliance server".  This does not look same as "firewall" or "security appliance". Searching on Cisco site also did not help.</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>Is anybody aware if this is a component of ASA/firewall itself or anything external, and when do these events occur in normal course of operartions in PIX/ASA (I did not find see these messages occuring in our test environment atleast). Any pointers would be appreciated.</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2></FONT></SPAN> </DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>Thanks</FONT></SPAN></DIV>
<DIV><SPAN class=234103801-15022008><FONT face=Arial size=2>Anusuya</FONT></SPAN></DIV></DIV></DIV><BR>
<HR SIZE=1>
Looking for last minute shopping deals? <A href="http://us.rd.yahoo.com/evt=51734/*http://tools.search.yahoo.com/ne
wsearch/category.php?category=shopping" target=_blank rel=nofollow>Find them fast with Yahoo! Search.</A></DIV><BR></DIV></div><br>
<hr size=1>Be a better friend, newshound, and
know-it-all with Yahoo! Mobile. <a href="http://us.rd.yahoo.com/evt=51733/*http://mobile.yahoo.com/;_ylt=Ah
u06i62sR8HDtDypao8Wcj9tAcJ "> Try it now.</a></body></html>_______________________________________________
LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus