LogAnalysis
Re: [logs] Information about Cisco ASA "Firewall Server" messages Feb 15 2008 08:54PM
Anusuya K (anusuya_k yahoo com)
Thanks for replying. But my concern is more about the term "Security appliance server", and how is it different from "Security appliance" (I guess in PIX it would be Firewall server vs Firewall).

Thanks
Anusuya

----- Original Message ----
From: "ronaldo (at) cheetah.netrusion (dot) com [email concealed]" <ronaldo (at) cheetah.netrusion (dot) com [email concealed]>
To: Anusuya K <anusuya_k (at) yahoo (dot) com [email concealed]>
Cc: loganalysis (at) loganalysis (dot) org [email concealed]
Sent: Friday, February 15, 2008 12:58:13 PM
Subject: Re: [logs] Information about Cisco ASA "Firewall Server" messages

Hi as per ASA 7.2 config guide it seems that the term security appliance
now references to the PIX
and ASA models that support the recent software versions

http://www.cisco.com/en/US/partner/docs/security/asa/asa72/configuration
/guide/about.html

This guide applies to the Cisco PIX 500 series security appliances (PIX
515E, PIX 525, and PIX 535) and the Cisco ASA 5500 series security
appliances (ASA 5505, ASA 5510, ASA 5520, ASA 5540, and ASA 5550).
Throughout this guide, the term "security appliance" applies generically
to all supported models, unless specified otherwise. The PIX 501, PIX
506E, and PIX 520 security appliances are not supported.

They seem to relate to remote access sessions (vpn)

On Thu, 14 Feb
2008, Anusuya K wrote:

> Hi,
> While analyzing the Cisco ASA 8.0 log messages I came across some VPN messages which refer to firewall server/Security appliance server. Following are some of them:
>
> %PIX|ASA-7-713160: Remote user (session Id - id) has been granted access by the Firewall Server
> %PIX|ASA-3-713161: Remote user (session Id - id) network access has been restricted by the Firewall Server
> %PIX|ASA-3-713162: Remote user (session Id - id) has been rejected by the Firewall Server
> %PIX|ASA-3-713163: Remote user (session Id - id) has been terminated by the Firewall Server
>
> Description of these messages refers to "Security appliance server" and not firewall server. I am not able to figure out what is the meaning of either "firewall server" or "security appliance server". This does not look same as "firewall" or "security appliance". Searching on Cisco site also did not help.
>
> Is anybody aware if this is a component of ASA/firewall itself or anything external, and when do these events occur in normal course of operartions in PIX/ASA (I did not find see these messages occuring in our test environment atleast). Any pointers would be appreciated.
>
> Thanks
> Anusuya
>
>
>
> Looking for last minute shopping deals? Find them fast with Yahoo! Search.
>
>
> ________________________________________________________________________
____________
> Never miss a thing. Make Yahoo your home page.
> http://www.yahoo.com/r/hs

________________________________________________________________________
____________
Looking for last minute shopping deals?
Find them fast with Yahoo! Search. http://tools.search.yahoo.com/newsearch/category.php?category=shopping<h
tml><head><style type="text/css"><!-- DIV {margin:0px;} --></style></head><body><div style="font-family:times new roman, new york, times, serif;font-size:12pt"><P>Thanks for replying. But my concern is more about the term "Security appliance server", and how is it different from "Security appliance" (I guess in PIX it would be Firewall server vs Firewall). </P>
<P> </P>
<P>Thanks</P>
<P>Anusuya<BR><BR></P>
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">
<DIV style="FONT-SIZE: 12pt; FONT-FAMILY: times new roman, new york, times, serif">----- Original Message ----<BR>From: "ronaldo (at) cheetah.netrusion (dot) com [email concealed]" <ronaldo (at) cheetah.netrusion (dot) com [email concealed]><BR>To: Anusuya K <anusuya_k (at) yahoo (dot) com [email concealed]><BR>Cc: loganalysis (at) loganalysis (dot) org [email concealed]<BR>Sent: Friday, February 15, 2008 12:58:13 PM<BR>Subject: Re: [logs] Information about Cisco ASA "Firewall Server" messages<BR><BR>Hi as per ASA 7.2 config guide it seems that the term security appliance <BR>now references to the PIX <BR>and ASA models that support the recent software versions<BR><BR><A href="http://www.cisco.com/en/US/partner/docs/security/asa/asa72/configu
ration/guide/about.html" target=_blank>http://www.cisco.com/en/US/partner/docs/security/asa/asa72
/configuration/guide/about.html</A><BR><BR><BR>This guide applies to the Cisco PIX 500 series security appliances (PIX <BR>515E, PIX 525, and PIX 535) and the Cisco ASA 5500 series security <BR>appliances (ASA 5505, ASA
5510, ASA 5520, ASA 5540, and ASA 5550). <BR>Throughout this guide, the term "security appliance" applies generically <BR>to all supported models, unless specified otherwise. The PIX 501, PIX <BR>506E, and PIX 520 security appliances are not supported.<BR><BR>They seem to relate to remote access sessions (vpn)<BR><BR>On Thu, 14 Feb <BR>2008, Anusuya K wrote:<BR><BR>> Hi,<BR>>  While analyzing the Cisco ASA 8.0 log messages I came across some VPN messages which refer to firewall server/Security appliance server. Following are some of them:<BR>><BR>> %PIX|ASA-7-713160: Remote user (session Id - id) has been granted access by the Firewall Server<BR>> %PIX|ASA-3-713161: Remote user (session Id - id) network access has been restricted by the Firewall Server<BR>> %PIX|ASA-3-713162: Remote user (session Id - id) has been rejected by the Firewall Server<BR>> %PIX|ASA-3-713163: Remote user (session Id - id) has been terminated by the
Firewall Server<BR>><BR>> Description of these messages refers to "Security appliance server" and not firewall server. I am not able to figure out what is the meaning of either "firewall server" or "security appliance server".  This does not look same as "firewall" or "security appliance". Searching on Cisco site also did not help.<BR>><BR>> Is anybody aware if this is a component of ASA/firewall itself or anything external, and when do these events occur in normal course of operartions in PIX/ASA (I did not find see these messages occuring in our test environment atleast). Any pointers would be appreciated.<BR>><BR>> Thanks<BR>> Anusuya<BR>><BR>><BR>><BR>> Looking for last minute shopping deals? Find them fast with Yahoo! Search.<BR>><BR>><BR>>      ________________________________________________________________________
____________<BR>> Never miss a thing.  Make Yahoo your home
page.<BR>> <A href="http://www.yahoo.com/r/hs" target=_blank>http://www.yahoo.com/r/hs</A><BR></DIV><BR></DIV></div><br
>
<hr size=1>Looking for last minute shopping deals? <a href="http://us.rd.yahoo.com/evt=51734/*http://tools.search.yahoo.com/ne
wsearch/category.php?category=shopping">
Find them fast with Yahoo! Search.</a></body></html>_______________________________________________

LogAnalysis mailing list
LogAnalysis (at) loganalysis (dot) org [email concealed]
http://www.loganalysis.org/mailman/listinfo/loganalysis

[ reply ]


 

Privacy Statement
Copyright 2010, SecurityFocus