Catalyst 6500 Series Switch and Cisco 7600 Series Router Firewall Services Module Installation and Configuration Note, 1.1(2)
Appendix C System Messages
Downloads: This chapterpdf (PDF - 477.0KB) The complete bookPDF (PDF - 4.49MB) | Feedback

System Messages

Table Of Contents

System Messages

System Log Messages

System Message Log Differences

Failover Messages

Connection Messages

FTP and URL

HTTP

ICMP

Routing Messages

H.225

H.245

H.323

IP Fragmentation

SIP

Skinny

RSH

RTSP

SMTP

TCP

UDP

SSH

Telnet

AAA and ACL

User Management

Configuration

FWSM Management

PDM

Stateful Failover

Memory and Resource Allocation

SNMP

DHCP

VPN

Internet Protocol Routing

OSPF

Shun


System Messages


This appendix provides the list of system log messages supported in the Firewall Services Module. The module functions similarly to the PIX firewall application software. Refer to the System Log Messages for the Cisco Secure PIX Firewall Version 6.0 documentation for information about the system message logs. The messages are listed by type and by message code within each type.

This appendix includes the following sections:

System Log Messages

System Message Log Differences

Failover Messages

Connection Messages

SSH

Telnet

AAA and ACL

User Management

Configuration

FWSM Management

PDM

Stateful Failover

Memory and Resource Allocation

SNMP

DHCP

VPN

Internet Protocol Routing

OSPF

Shun


Note The messages shown in this appendix apply to Firewall Services Module version 1.1(1) and higher. When a number is skipped from a sequence, for example, 106019, the message is no longer in the firewall code.


You can configure the module system software to send these messages to the output location of your choice. For example, you can specify that log messages be sent to the console, to any Telnet session actively connected to the module console, or to a logging server elsewhere on the network.

The module provides three output locations for sending syslog messages: the console, a host running a syslog server, and an SNMP management station. If you send messages to a host, they are sent using either UDP or TCP. The host must have a program (known as a server) called syslogd.

The syslog server runs a Windows NT-based system that accepts TCP and UDP system log messages. The syslog server provides time-stamped syslog messages, accepts messages on alternate ports, and in TCP mode stops the firewall traffic if the server log disk is full or the server goes down.

System Log Messages

System log messages received at a syslog server begin with a percent sign (%) and are structured as follows:

%FWSM-Level-Message_number: Message_text

FWSM identifies the message facility code for messages generated by the Firewall Services Module.

Level reflects the severity of the condition described by the message. The lower the number, the more severe the condition. Table C-1 lists the severity levels. Logging is set to level 3 (error) by default.

Table C-1 Log Message Security Levels

Level Number
Level Keyword
Description

0

emergency

System unusable

1

alert

Immediate action needed

2

critical

Critical condition

3

error

Error condition

4

warning

Warning condition

5

notification

Normal but significant condition

6

informational

Informational message only

7

debugging

Appears during debugging only


Message_number is the numeric code that uniquely identifies the message.

Message_text is a text string describing the condition. This portion of the message sometimes includes IP addresses, port numbers, or usernames. Table C-2 lists the variable fields and the type of information in them.

Table C-2 Variable Fields in Syslog Messages 

Variable
Type of Information

chars

Text string (for example, a username).

dec

Decimal number.

dest_addr

Destination address.

faddr

Foreign IP address, an address of a host typically on a lower security level interface in a network beyond the outside router.

fport

Foreign port number.

gaddr

Global IP address, an address on a lower security level interface.

hex

Hexadecimal number.

interface_name, int_name

Interface name.

interface_number

Use the show nameif command to determine which interface is being described in a message containing this variable. For example:

show nameif 
nameif ethernet0 outside security0 
nameif ethernet1 inside security100 
nameif token0 outside security20 
nameif ethernet2 inside security30

In this example, ethernet0 would appear in a syslog message as interface 0, ethernet1 would be interface 1, token0 would be interface 2, and ethernet2 would be interface 3.

laddr

Local IP address, an address on a higher security level interface.

lport

Local port number.

octal

Octal number.

ip_addr/ip_address

IP address (for example, 192.168.1.2).

ip_mask

IP mask (for example 255.255.255.0)

port

Port number.

reason

Message string

return_code

Return code.

src_addr

Source address.

time

Duration, in the format hh:mm:ss.

TCP_flags

TCP flag values.



Note Syslog messages received at the module serial console contain only the code portion of the message. When you view the message description the severity level is provided.


System Message Log Differences

The module provides the following differences to the system message logging of the PIX firewall software:

Syslog level changes for the module to reduce the number of syslog entries per connection from 4 to 2 at Info(6) level:

Portmapped translation built (305001) changed from Info (6) to Debug(7)

Translation built (305002) changed from Info (6) to Debug(7)

Teardown translation (305003) changed from Info (6) to Debug(7)

Teardown portmap translation (305004) changed from Info (6) to Debug(7)

Syslog level changes for consistency purposes:

PreAllocate H323 UDP Connection (302004) changed from Info(6) to Debug(7)

Built H245 Connection (302003) changed from Info (6) to Debug(7)

PreAllocate H225 Connection (302012) changed from Info(6) to Debug(7)

PreAllocate SIP Secondary Channel (607001) changed from Info(6) to Debug(7)

PreAllocate Skinny Secondary Channel (608001) changed from Info(6) to Debug(7)

PreAllocate RTSP UDP Connection (314001) changed from Info(6) to Debug(7)

Syslog changes for Deny By Access Group (106023) Warning(4):

After a threshold has been reached, you can generate syslog only if the connection gets dropped for a specific access control rule n number of times (n is a global configurable item).

After a threshold has been reached, you can generate syslog once every t seconds with the ACL rule parameter that is getting hit (t is a global configurable item).

Deny Inbound (106010) changed from Error (3) to Info(4).

Syslog messages generated by network processes are based on the interface. You can configure the module to either drop a new connection when the threshold is reached through that interface or allow the new connection without generating a syslog message.

Failover Messages

This section contains the messages generated by a failover configuration.

Error Message    %FWSM-1-103001: (Primary) No response from other firewall (reason code 
= code).

Explanation    This message indicates that the primary module is unable to communicate with the secondary module over the failover cable. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify that the secondary module has the exact same hardware, software version level, and configuration as the primary module.

Error Message    %FWSM-1-103002: (Primary) Other firewall network interface 
interface_name OK.

Explanation    This message indicates that the primary module detected that the network interface on the secondary module is acceptable. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-103003: (Primary) Other firewall network interface 
interface_name failed.

Explanation    This message indicates that the primary module detects a bad network interface on the secondary module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Check the network connections on the secondary module, and check the network hub connection. If necessary, replace the failed network interface.

Error Message    %FWSM-1-103004: (Primary) Other firewall reports this firewall failed.

Explanation    This message indicates that the primary module receives a message from the secondary module indicating that the primary has failed. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify the status of the primary module.

Error Message    %FWSM-1-103005: (Primary) Other firewall reporting failure.

Explanation    This message indicates that the secondary module reports a failure to the primary module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify the status of the secondary module.

Error Message    %FWSM-1-104001: (Primary) Switching to ACTIVE (cause: reason).
%FWSM-1-104002: (Primary) Switching to STNDBY (cause: reason).

Explanation    Both instances are failover messages. These messages are logged when you force the failover module pair to switch roles. You can force the failover module pair to switch roles by either entering the failover active command on the secondary module or the no failover active command on the primary module. (Primary) can also be listed as (Secondary) for the secondary module. Possible values for the reason variable are as follows:

State check

Bad or incomplete configuration

Interface check, mate is healthier

The other module wants to be standby

In failed state, cannot be active

Switch to failed state

Recommended Action    If the message occurs because of manual intervention, no action is required. Otherwise, use the cause reported by the secondary module to verify the status of both modules of the pair.

Error Message    %FWSM-1-104003: (Primary) Switching to FAILED.

Explanation    This message indicates that the primary module fails.

Recommended Action    Check the system log messages for the primary module for an indication of the nature of the problem (see message %FWSM-1-104001:). (Primary) can also be listed as (Secondary) for the secondary module.

Error Message    %FWSM-1-104004: (Primary) Switching to OK.

Explanation    This message indicates that a previously failed module now reports that it is operating again. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105001: (Primary) Disabling failover.

Explanation    This message indicates that you entered the no failover command on the console. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105002: (Primary) Enabling failover.

Explanation    This message indicates that you entered the failover command with no arguments on the console, after having previously disabled failover. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105003: (Primary) Monitoring on interface int_name waiting

Explanation    The firewall is testing the specified network interface with the other module of the failover pair.

Recommended Action    None required. The firewall monitors its network interfaces frequently during normal operations.

Error Message    %FWSM-1-105004: (Primary) Monitoring on interface int_name normal

Explanation    The test of the specified network interface was successful. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105005: (Primary) Lost Failover communications with mate on 
interface int_name.

Explanation    This message indicates that this module of the failover pair can no longer communicate with the other module of the pair. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify that the network connected to the specified interface is functioning correctly.

Error Message    %FWSM-1-105006: (Primary) Link status 'Up' on interface int_name.
%FWSM-1-105007: (Primary) Link status 'Down' on interface int_name.

Explanation    Both instances are failover messages. These messages report the results of monitoring the link status of the specified interface. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    If the link status is down, verify that the network connected to the specified interface is operating correctly.

Error Message    %FWSM-1-105008: (Primary) Testing interface int_name.

Explanation    This message indicates that the firewall tested a specified network interface. This testing is performed only if the firewall fails to receive a message from the standby module on that interface after the expected interval. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105009: (Primary) Testing on interface int_name result.

Recommended Action    This message reports the result (either Passed or Failed. Allocation is required if the result is Passed. If the result is Failed, you should check to be sure the network cable is properly connected to both failover modules and that the network itself is functioning correctly, and verify the status of the standby module.

Error Message    %FWSM-3-105010: (Primary) Failover message block alloc failed

Explanation    Block memory has been depleted. This is a transient message and the firewall should recover. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Use the show blocks command to monitor the current block memory.

Error Message    %FWSM-1-105011: (Primary) Failover cable communication failure

Explanation    The failover cable is not permitting communication between the primary and secondary modules. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Ensure that the cable is properly connected.

Error Message    %FWSM-1-105020: (Primary) Incomplete/slow config replication

Explanation    When a failover occurs, the active firewall detects a partial configuration in memory. This situation is caused by an interruption in the replication service. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Once the failover is detected by the firewall, the firewall automatically reloads itself and loads the configuration from Flash and resynchronizes with another firewall. If failovers happen continuously, check the failover configuration and make sure both firewalls can communicate with each other.

Error Message    %FWSM-1-105038: (Primary) Interface count mismatch 

Explanation    Failover initially verifies that the number of interfaces configured on the primary and secondary modules are the same. This message indicates that after the verification that the numbers are not the same. Failover cannot be enabled until both primary and secondary modules have the same number of interfaces. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Check the VLAN configuration on the primary and secondary modules. Check for any nameif command failure on the primary module. (Primary) can also be listed as (Secondary) for the secondary module. Once these configurations are verified and corrected, type failover on the primary module to enable failover again.

Error Message    %FWSM-1-105039: (Primary) Unable to verify the Interface count with 
mate. Failover may be disabled in mate. 

Explanation    Failover initially verifies that the number of interfaces configured on the primary and secondary modules are the same. This message indicates that the primary module is not able to verify the number interfaces configured on the secondary module. This indicates that the primary module is not able communicate with the secondary module over the failover interface. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify the failover VLAN, interface configuration and status on the primary and secondary modules. Make sure the secondary module is running the firewall application and failover is enabled. (Primary) can also be listed as (Secondary) for the secondary module.

Error Message    %FWSM-1-105040: (Primary) Mate failover version is not compatible.

Explanation    The primary and secondary module should run the same failover software version to act as a failover pair. This message indicates that the secondary module's failover software version is not compatible with the primary module. Failover would be disabled on the primary module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Maintain consistent software versions between the primary and secondary modules to enable failover.

Error Message    %FWSM-1-105041: (Primary) nameif command failed. Number of interfaces 
is not consistent with mate.

Explanation    This message indicates that during a configuration sync from the secondary to the primary module the nameif command has failed in the primary module. The nameif command, defines the firewall interfaces in the Firewall Services Module. If this command fails during synchronization, the result is that the interfaces are inconsistent across the failover modules. To avoid this situation, failover is disabled. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Correct the reason why nameif failed, and then enable failover.

Error Message    %FWSM-1-105042: (Primary) Failover interface OK 

Explanation    Interface used to send failover messages to the secondary module is functioning. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-105043: (Primary) Failover interface failed 

Explanation    Interface used to send failover messages to the secondary module failed. The active module remains as active and the standby module remains as standby. There will not be any failure detection or switchover activity until the failover interface becomes normal. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    Verify the VLAN and interface configuration of the failover interface is primary and secondary.

Connection Messages

This section contains connection messages and the messages specific to the following message types:

FTP and URL

Routing Messages

ICMP

Routing Messages

RSH

RSH

SMTP

Routing Messages

ICMP

Error Message    %FWSM-2-106002: protocol Connection denied by outbound list list_ID 
src laddr dest faddr

Explanation    This message indicates that the specified connection failed because of an outbound deny command statement. The protocol variable can be ICMP, TCP, or UDP.

Recommended Action    Use the show outbound command to check outbound lists.

Error Message    %FWSM-4-106010: Deny inbound protocol src 
interface_name:dest_address/dest_port dst 
interface_name:source_address/source_port 

Explanation    This is a connection-related message. This message is logged if an inbound connection is denied by your security policy.

Error Message    Modify the security policy if traffic should be permitted. If the message occurs at regular intervals, contact the remote peer administrator. 
Error Message    %FWSM-7-106011: Deny inbound (No xlate) chars

Explanation    This message indicates that a packet was sent to the same interface that it arrived on. This usually indicates that a security breach is occurring. When the module receives a packet, it tries to establish a translation slot based on the security policy you set with the access-list commands, and your routing policy set with the route command.

When the module polls both policies, the module allows the packet to flow from the higher priority network to a lower priority network, if it is consistent with the security policy. If a packet comes from a lower priority network and the security policy does not allow it, the module routes the packet back to the same interface.

To provide access from an interface with a higher security to a lower security, use the nat and global commands. For example, use the nat command to allow internal users access to external servers, to allow the internal users to access perimeter servers, and to allow perimeter users access to external servers.

To provide access from an interface with a lower security level to a higher security level, use the static and access-list commands. For example, use the static and access-list commands to let external users to access internal servers, external users to access perimeter servers, or perimeter servers to access internal servers.

Recommended Action    Fix your configuration to reflect your security policy for handling these attack events.

Error Message    %FWSM-2-106016: Deny IP spoof from (IP_addr) to IP_addr on interface 
int_name.

Explanation    This message indicates that the module discards a packet with an invalid source address. Invalid sources addresses are those addresses belong to the following:

Loopback network (127.0.0.0)

Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)

The destination host (land.c)

If a sysopt connection enforce subnet is enabled, the module discards those packets with an invalid source subnet preventing them from traversing the firewall and then logs this message.

To further spoof-packet detection, use the access-list command to configure the firewall to discard packets with source addresses belonging to the internal network.

Recommended Action    Determine if an external user is trying to compromise the protected network. Check for incorrectly configured clients.

Error Message    %FWSM-2-106017: Deny IP due to Land Attack from IP_addr to IP_addr

Explanation    This message indicates that the module received a packet with the IP source address equal to the IP destination and the destination port equal to the source port. This indicates a spoofed packet that is designed to attack systems. This attack is referred to as a land attack. If this message persists, an attack may be in progress. The packet does not provide enough information to determine where the attack originates.

Recommended Action    None.

Error Message    %FWSM-2-106020: Deny IP teardrop fragment (size = num, offset = num) 
from IP_addr to IP_addr

Explanation    The firewall discarded an IP packet with a teardrop signature containing either a small offset or fragment overlapping. This is a hostile event to circumvent the module or an intrusion detection system.

Recommended Action    Contact the remote peer administrator or escalate this issue according to your security policy.

Error Message    %FWSM-1-106021: Deny protocol reverse path check from src_addr to 
dest_addr on interface int_name

Explanation    Someone is attempting to spoof an IP address on an inbound connection. Unicast Reverse Path Forwarding, also known as reverse route lookup, detected a packet that does not have a source address represented by a route and assumes it to be part of an attack on your module.

This message indicates that you have enabled Unicast Reverse Path Forwarding with the ip verify reverse-path command. This feature works on packets sent to an interface; if it is configured on the outside, then the module checks packets arriving from the outside. The following conditions apply:

The module looks up a route based on the src_addr. If an entry is not found and a route is not defined, then this syslog message appears and the connection is dropped.

If there is a route, the module checks which interface it corresponds to. If the packet arrived on another interface, then it is a spoof or there is an asymmetric routing environment. The firewall does not support asymmetric routing (where there is more than one path to a destination).

If configured on an internal interface, the module checks static route command statements or RIP and if the source address is not found, then an internal user is spoofing their address.

Recommended Action    An attack is in progress. With this feature enabled, no user action is required. The module repels the attack.

Error Message    %FWSM-3-201002: Too many connections on static|xlate gaddr! econns 
nconns

Explanation    This message indicates that the maximum number of connections to the specified static address has been exceeded. The econns variable is the maximum number of embryonic connections and nconns is the maximum number of connections permitted for the static or translate (xlate).

Recommended Action    Use the show static command to check the limit imposed on connections to a static address. The limit is configurable.

Error Message    %FWSM-2-201003: Embryonic limit exceeded neconns/elimit for 
faddr/fport (gaddr) laddr/lport on interface int_name

Explanation    This message indicates that the maximum number of embryonic connections from the specified foreign address through the specified static global address to the specified local address has been exceeded. When the limit on embryonic connections is reached, the module attempts to accept them anyway, but puts a time limit on the connections. This allows some connections to succeed even if the module is very busy. The neconns variable lists the number of embryonic connections received and the limit variable lists the maximum number of embryonic connections specified in the static or nat command. This message indicates a more serious overload than indicated in message 201002. The overload could be caused by SYN attacks, or by a very heavy load of legitimate traffic.

Recommended Action    Use the show static command to check the limit imposed on embryonic connections to a static address.

Error Message    %FWSM-3-407002: Embryonic limit neconns/elimit for through connections 

Explanation    This message provides information about connections through the firewall. This message indicates that the number of connections from a specified foreign address over a specified global address to the specified local address exceeds the maximum embryonic limit for that static. The module attempts to accept the connection if it can allocate memory for that connection. It proxies on behalf of local host and sends a SYN_ACK packet to the foreign host. The module retains pertinent state information, drops the packet, and waits for the client's acknowledgment.

Recommended Action    The traffic may be legitimate, or this message might indicate that a denial of service (DoS) attack is in progress. Check the source address to determine where the packets are coming from and whether it is a valid host.

Error Message    %FWSM-3-202001: Out of address translation slots!

Explanation    This message indicates that the module has no more address translation slots available.

Recommended Action    Check the size of the global pool compared to the number of inside network clients. A PAT address may be necessary. Alternatively, shorten the timeout interval of translates and connections. This message may also be caused by insufficient memory; reduce the amount of memory usage, or purchase additional memory.

Error Message    %FWSM-3-202005: Non-embryonic in embryonic list faddr/fport 
laddr/lport

Explanation    This message indicates that a connection object (xlate) is in the wrong list.

Recommended Action    Contact your customer support representative.

Error Message    %FWSM-3-208005: (function:line_num) FWSM clear command return 
return_code

Explanation    The module received a non-zero value (an internal error) when attempting to clear the configuration in Flash memory. The message includes the reporting subroutine's filename and line number.

Recommended Action    For performance reasons, the end host should be configured to not inject IP fragments. This message probably occurred because of NFS. Set the read and write size to be the interface MTU for NFS.

Error Message    %FWSM-6-305001:Portmapped translation built for gaddr IP_addr/port 
laddr IP_addr/port

Explanation    This message indicates that a translate (xlate) is created for outbound traffic using a PAT global address. This message applies to UDP, TCP, and ICMP packets.

Recommended Action    None required.

Error Message    %FWSM-6-305002:Translation built for gaddr IP_addr to laddr IP_addr

Explanation    This message indicates that a translate (xlate) is created for outbound traffic using a global address, or for either outbound or inbound traffic using a static address.

Recommended Action    None required.

Error Message    %FWSM-6-305003:Teardown translation for global IP_addr local IP_addr

Explanation    This message indicates that the firewall clears a dynamically allocated translation after the translate timeout expires.

Recommended Action    None required.

Error Message    %FWSM-6-305004:Teardown portmap translation for global IP_addr/port 
local IP_addr/port

Explanation    This message indicates that a port-mapped translation (PAT xlate) no longer in use has been reclaimed.

Recommended Action    None required.

Error Message    %FWSM-3-305005: No translation group found for protocol.

Explanation    This message indicates that a NAT and global command cannot be found for a protocol. The protocol can be TCP, UDP, or ICMP.

Recommended Action    This message can be either an internal error or an error in the configuration.

Error Message    %FWSM-3-305006: Regular translation creation failed for protocol src 
int_name:IP_addr/port dst int_name:IP_addr/port

Explanation    A protocol (UDP, TCP, or ICMP) failed to create a translation through the module. This message appears as a fix to caveat CSCdr0063, which requested that the module not allow packets destined to network or broadcast addresses. The module provides this checking for addresses that are explicitly identified with static command statements. With the change, for inbound traffic, the module denies translations for a destined IP address identified as a network or broadcast address.

The module uses the global IP and mask from configured static command statements to differ regular IP addresses from network or broadcast IP addresses. If the global IP address is a valid network address with a matching network mask, then the module will not create a translate (xlate) for network or broadcast IP addresses with inbound packets.

Recommended Action    This message can be either an internal error or an error in the configuration.

Error Message    %FWSM-6-305007: Orphan IP IP_addr on interface interface_name

Explanation    This message indicates that after the module attempts to translate an address that it cannot find in any of its global pools it assumes that the address has been deleted and drops the request.

Recommended Action    None required.

Error Message    %FWSM-6-609001: Built local-host int_name:ip_addr

Explanation    A network state container is reserved for the host IP address connected to the interface name. This is an informational message.

Recommended Action    None required.

Error Message    %FWSM-6-609002: Teardown local-host int_name:ip_addr duration hh:mm:ss

Explanation    A network state container for the host IP address connected to interface name is removed. This is an informational message.

Recommended Action    None required.

Error Message    %FWSM-3-305008: Free unallocated global IP address.

Explanation    This message indicates an inconsistency condition when trying to free an unallocated global IP address back to the address pool. This abnormal condition may occur if the module is running a stateful failover setup and some of the internal states are momentarily out of sync between the active and standby module. This condition is not catastrophic and the module will recover automatically.

Recommended Action    Report this condition to Cisco technical support if you continue to see this message.

Error Message    %FWSM-4-307004: Telnet session limit exceeded. Connection request from 
IP_addr on interface int_name.

Explanation    This message indicates that the maximum number of Telnet connections to the module is exceeded. The module denies an attempt to connect to its Telnet port from the specified IP address on the specified network.

Recommended Action    None required.

Error Message    %FWSM-4-308002: static gaddr1 laddr1 netmask mask1 overlapped with 
gaddr2 laddr2

Explanation    This message indicates that the IP addresses in one or more static command statements overlap. gaddr is the global address, which is the address on the lower security interface and laddr is the local address, which is the address on the higher security level interface.

Recommended Action    Use the show static command to view the static command statements in your configuration and fix the commands that overlap. The most common overlap occurs if you specify a network address, such as 10.1.1.0, and in another static command statement specify a host within that range such as 10.1.1.5.

Error Message    %FWSM-4-500004: Invalid transport field for protocol=protocol, from 
src_addr/src_port to dest_addr/dest_port

Explanation    This message indicates there is an invalid transport number, in which the source or destination port number for a protocol is zero. The protocol field is 6 for TCP and 17 for UDP.

Recommended Action    If these messages persist, contact the peer's administrator.

FTP and URL

Error Message    %FWSM-3-201005: FTP data connection failed for IP_addr

Explanation    This message indicates that the module is unable to allocate a structure to track the data connection for FTP because of insufficient memory.

Recommended Action    Reduce the amount of memory usage, or purchase additional memory.

Error Message    %FWSM-6-303002: src_addr Stored|Retrieved dest_addr: nat_addrs

Explanation    This message indicates that the specified host successfully stores or retrieves data from the specified FTP site. This message is used by the module manager to generate reports.

Recommended Action    None required.

Error Message    %FWSM-5-304001: user src_addr Accessed JAVA URL|URL dest_addr: url.

Explanation    This message indicates that the specified host successfully accesses the specified URL. This message is used by the module manager to generate reports.

Recommended Action    None required.

Error Message    %FWSM-5-304002: Access denied URL chars SRC IP_addr DEST IP_addr: chars

Explanation    This message indicates that access from the source address failed.

Recommended Action    None required.

Error Message    %FWSM-3-304003: URL Server IP_addr timed out URL string

Explanation    This message indicates that access from the URL server failed.

Recommended Action    None required.

Error Message    %FWSM-6-304004: URL Server IP_addr request failed URL chars

Explanation    This message indicates that a Websense server request fails.

Recommended Action    None required.

Error Message    %FWSM-7-304005: URL Server IP_addr request pending URL chars

Explanation    This message indicates that a Websense server request is pending.

Recommended Action    None required.

Error Message    %FWSM-3-304006: URL Server IP_addr not responding

Explanation    The Websense server is unavailable for access, and the module attempts to either try to access the same server if it is the only server installed or another server if there is more than one.

Recommended Action    None required.

Error Message    %FWSM-2-304007: URL Server IP_addr not responding, ENTERING ALLOW 
mode.

Explanation    This message indicates that when you use the allow option of the filter command the Websense servers are not responding. The module allows all Web requests to continue without filtering while the servers are not available.

Recommended Action    None required.

Error Message    %FWSM-2-304008: LEAVING ALLOW mode, URL Server is up.

Explanation    This message indicates that when you use the allow option of the filter command that the module received a response message from a Websense server that previously was not responding. With this response message, the module exits the allow mode and enables the URL filtering feature again.

Recommended Action    None required.

Error Message    %FWSM-4-406001: FTP port command low port: laddr, port to gaddr on 
interface int_number

Explanation    This message indicates the port is not responding.

Recommended Action    None required.

Error Message    %FWSM-4-406002: FTP port command different address: laddr to gaddr on 
interface int_number

Explanation    This message indicates the interface address is incorrect.

Recommended Action    None required.

HTTP

Error Message    %FWSM-6-605001: HTTP daemon interface int_name: Connection denied from 
IP_addr

Explanation    This message indicates that an HTTP connection to the module was denied.

Recommended Action    None required.

Error Message    %FWSM-6-605002: HTTP daemon connection limit exceeded

Explanation    This message indicates that the number of HTTP connections to the module for Cisco Secure PDM was exceeded.

Recommended Action    None required.

Error Message    %FWSM-6-605003: HTTP daemon: Login failed from IP_addr for user 
"user_id"

Explanation    This message indicates that Cisco Secure PDM login to the module failed.

Recommended Action    None required.

ICMP

Error Message    %FWSM-6-106010: Deny inbound icmp src outside: IP_addr dst inside: 
IP_addr (type dec, code dec)

Explanation    This message indicates that an inbound connection is denied by your security policy.

Recommended Action    None required.

Explanation    This message indicates that the module discards an inbound ICMP Echo Request packet with a destination address that corresponds to a PAT global address. It is discarded because the inbound packet cannot specify which PAT host should receive the packet.

Recommended Action    None required.

Error Message    %FWSM-3-106014: Deny inbound icmp src interface name: IP_addr dst 
interface name: IP_addr (type dec, code dec) 

Explanation    This message indicates that the module denies any inbound ICMP packet access. By default, all ICMP packets are denied access unless specifically permitted using the icmp permit icmp command.

Recommended Action    None required.

Error Message    %FWSM-2-106018: ICMP packet type ICMP_type denied by outbound list 
list_ID src laddr dest faddr

Explanation    This message indicates that the outgoing ICMP packets with a specified ICMP type from a local host to a foreign host is denied by the outbound list.

Recommended Action    None required.

Error Message    %FWSM-3-313001: Denied ICMP type=icmp_type, code=type_code from 
IP_addr on interface int_name

Explanation    When using the icmp command with an access list, if the first matched entry is a permit entry, ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry is not matched, the module discards the ICMP packet and generates this syslog message. The icmp command enables or disables pinging to an interface. With pinging disabled, the module cannot be detected on the network. This feature is also referred to as configurable proxy pinging.

Recommended Action    Contact the peer's administrator.

Error Message    %FWSM-3-313003: Invalid destination, ICMP-packet-description, on 
interface-name interface. Original IP payload, packet-description

Explanation    The destination for the ICMP error message is different from the source of the IP packet that generated the ICMP error message.

Recommended Action    If the message occurs frequently, this could be an active network probe, an attempt to use the ICMP error message as a covert channel, or an IP host that is not operating properly. Contact the administrator of the host that originated the ICMP error message.

Error Message    %FWSM-6-602101: PMTU-D packet packet_length bytes greater than 
effective mtu mtu_value dest_addr=dest_ip, src_addr=source_ip, prot=protocol

Explanation    This message occurs when the module sends an ICMP destination unreachable message and when fragmentation is needed, but the don't-fragment bit is set.

Recommended Action    Ensure that the data is sent correctly.

Routing Messages

This section contains the messages generated by the router configuration.

Error Message    %FWSM-1-107001: RIP auth failed from IP_addr: version=vers, type=type, 
mode=mode, sequence=seq on interface int_name

Explanation    This is an alert log message. The module received a RIP reply message with bad authentication. This could be due to an incorrectly configured router or the module or it could be a unsuccessful attempt to attack the module's routing table.

Recommended Action    This may be an attack and should be monitored. If you are not familiar with the source IP address listed in this message, change your RIP authentication keys between trusted entities. An attacker may be trying to deduce the existing keys.

Error Message    %FWSM-1-107002: RIP pkt failed from IP_addr: version=vers on interface 
int_name

Explanation    This is an alert message. This message indicates a router bug, a packet with non-RFC values inside, or malformed entries. This situation should not happen and may be an attempt to exploit the firewall module's routing table.

Recommended Action    This may be an attack and should be monitored. The packet has passed authentication, if enabled, and bad data is in the packet. The situation should be monitored and the keys should be changed if there are any doubts as to the originator of the packets.

Error Message    %FWSM-6-110001: No route to dest_addr from src_addr

Explanation    This message indicates a route lookup failure. A packet is looking for a destination IP address, which is not in the routing table.

Recommended Action    Check the routing table and make sure there is a route to the destination.

Error Message    %FWSM-3-110002: No ARP for host IP_addr

Explanation    This is a routing message. This message indicates that the module cannot resolve the address of a host on one of its immediately connected networks. This usually occurs if the specified host does not exist or is not reachable on the network. The module expects it to be on, for example, if the host's address is incorrectly subnetted.

Recommended Action    Check the ARP table and ensure the host is available. If necessary, add a static ARP statement with the arp command or set the arp timeout value lower so that the ARP table will refresh sooner.

Check that the host's IP address is appropriate to the network topology and your subnet scheme. Verify that the host is reachable by pinging it from another host. Use the show arp command to display the module's ARP table.The module minimally must be able to resolve the addresses of its SNMP server, routers, and syslog host.

Error Message    %FWSM-6-312001: RIP hdr failed from IP_addr: cmd=cmd, version=vers 
domain=name on interface int_name

Explanation    The module received a RIP message with an operation code other than reply, the message has a version number different than what is expected on this interface, and the routing domain entry was non-zero.

Recommended Action    This message is informational, but may also indicate that another RIP device is not configured correctly to communicate with the module.

H.225

Error Message    %FWSM-4-405101: Unable to Pre-allocate H225 Call Signalling Connection 
for faddr faddr[/fport] to laddr laddr[/lport]

Explanation    The module failed to allocate RAM system memory while starting a connection or has no memory available.

Recommended Action    If this message occurs periodically, it can be ignored. If it repeats frequently, contact customer support. Also, check the size of the global pool compared to the number of inside network clients. A PAT address may be necessary. Alternatively, shorten the timeout interval of translates and connections. This message might be caused by insufficient memory; reduce the amount of memory usage, or purchase additional memory.

Error Message    %FWSM-4-405104: H225 message received from faddr/fport to laddr/lport 
before SETUP

Explanation    This message indicates that an H.225 message is received out of order. The H.225 message was received before the initial SETUP message, which is not allowed. The module has to receive an initial SETUP message for that H.225 call-signaling channel before accepting any other H.225 messages.

Recommended Action    None required.

Error Message    %FWSM-4-405103: H225 message from faddr/fport to laddr/lport contains 
bad protocol discriminator

Explanation    This message indicates that the message has incorrect protocol information.

Recommended Action    None required.

H.245

Error Message    %FWSM-7-302003: Built H245 connection for faddr faddr/fport laddr 
laddr/lport

Recommended Action    This message indicates that an H.245 connection is started from a foreign address to a local address. This message only occurs if the module detects the use of an Intel Internet phone. The foreign port (fport) only displays on connections from outside the module. The local port value (lport) only appears on connections started on an internal port.

Recommended Action    None required.

Error Message    %FWSM-4-405102: Unable to Pre-allocate H245 Connection for faddr 
faddr[/fport] to laddr laddr[/lport]

Explanation    The module failed to allocate RAM system memory while starting a connection or has no memory available.

Recommended Action    If this message occurs periodically, it can be ignored. If it repeats frequently, contact customer technical support. Also, check the size of the global pool compared to the number of inside network clients. A PAT address may be necessary. Alternatively, shorten the timeout interval of translates and connections. This message may also be caused by insufficient memory; reduce the amount of memory usage, or purchase additional memory.

H.323

Error Message    %FWSM-7-302004: Pre-allocate H323 UDP backconnection for faddr 
faddr/fport to laddr laddr/lport

Explanation    This message indicates that an H.323 UDP back-connection is preallocated to a foreign address from a local address. This message is only generated if the module detects the use of an Intel Internet phone. The foreign port (fport) only displays on connections from outside the module. The local port value (lport) only appears on connections started on an internal interface.

Recommended Action    None required.

Error Message    %FWSM-4-405103: H323 RAS message AdmissionConfirm received from %I/%d 
to %I/%d without an AdmissionRequest

Recommended Action    None required.

IP Fragmentation

Error Message    %FWSM-4-209003: Fragment database limit of bytes exceeded: src = 
IP_addr, dest = IP_addr, proto = protocol, id = ID

Explanation    Too many IP fragments are currently awaiting reassembly. By default, the maximum number of fragments is 1 (refer to the fragment command in the Cisco PIX Firewall Command Reference for more information). The firewall limits the number of IP fragments that can be concurrently reassembled. This restriction prevents memory depletion at the firewall under abnormal network conditions. In general, fragmented traffic should be a small percentage of the total traffic mix. A noticeable exception is in a network environment with NFS over UDP; if this type of traffic is relayed through the firewall, consider using NFS over TCP instead.

Refer to sysopt connection tcpmss bytes command in the Cisco PIX Firewall Command Reference for more information.

Refer to the sysopt connection tcpmss bytes command page in Chapter 5 of the Configuration Guide for the Cisco Secure Firewall Version 5.3 for more information.

Recommended Action    If this message persists, a DoS (denial of service) attack might be in progress. Contact the remote peer's administrator or upstream provider.

Error Message    %FWSM-4-209004: Invalid IP fragment, size = bytes exceeds maximum size 
= bytes: An IP fragment is malformed. 

Explanation    The total size of the reassembled IP packet exceeds the maximum possible size of 65,535 bytes.

Recommended Action    A possible intrusion event may be in progress. If this message persists, contact the remote peer's administrator or upstream provider.

Error Message    %FWSM-4-209005: Discard IP fragment set with more than number elements: 
src = Too many elements are in a fragment set. 

Explanation    The module disallows any IP packet that is fragmented into more than 24 fragments.

Recommended Action    A possible intrusion event may be in progress. If the message persists, contact the remote peer's administrator or upstream provider. You can change the number of fragments per packet by using the fragment chain xxx int_name command.

SIP

Error Message    %FWSM-7-607001: Pre-allocate SIP conn_type secondary channel for 
outside-interface:address/port to inside-interface:address from sip_message 
message 

Explanation    This message indicates that the fixup SIP preallocated a SIP connection after inspecting a SIP message.

Recommended Action    None required.

Skinny

Error Message    %FWSM-7-608001: Pre-allocate Skinny conn_type secondary channel for 
outside-interface:address to inside-interface:address/port from skinny_message 
message 

Explanation    This message indicates that the fixup skinny preallocated a Skinny connection after inspecting a Skinny message.

Recommended Action    None required.

RSH

Error Message    %FWSM-3-201005: FTP data connection failed for IP_addr

Explanation    This message indicates that the module cannot allocate a structure to track the data connection for FTP because of insufficient memory.

Recommended Action    Reduce the amount of memory usage, or purchase additional memory.

RTSP

Error Message    %FWSM-7-314001: Pre-allocate RTSP UDP back connection for faddr 
faddr/fport to laddr laddr/lport

Explanation    This message indicates that the module is unable to allocate and RTSP connection.

Recommended Action    None required.

SMTP

Error Message    %FWSM-2-108002: SMTP replaced chars: out src_addr in laddr data: chars

Explanation    This is generated by the fixup protocol smtp command. This message indicates that the module replaces an invalid character in an e-mail address with a space.

Recommended Action    None required.

TCP

Error Message    %FWSM-2-106001: Inbound TCP connection denied from IP_addr/port to 
IP_addr/port flags TCP_flags on interface int_name

Explanation    This message indicates that an attempt to connect to an inside address is denied by your security policy. Possible TCP_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the module, and it was dropped. The TCP_flags in this packet are FIN,ACK.

The TCP_flags are as follows:

ACK—The acknowledgment number was received.

FIN—Data was sent.

PSH—The receiver passed data to the application.

RST—The connection was reset.

SYN—Sequence numbers were synchronized to start a connection.

URG—The urgent pointer was declared valid.

Recommended Action    None required.

Error Message    %FWSM-6-106015: Deny TCP (no connection) from IP_addr/port to 
IP_addr/port flags flags on interface int_name.

Explanation    This message indicates that the module discards a TCP packet that has no associated connection in the module module's connection table. The module looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is not an existing connection, the module discards the packet.

Recommended Action    The action is required unless the module receives a large volume of these invalid TCP packets. If this is the case, trace the packets to the source and determine the reason these packets were sent.

Error Message    %FWSM-3-201009: TCP connection limit of limit-count for host 
host-address on interface exceeded

Explanation    This message indicates that the maximum number of connections to the specified static address was exceeded. The limit-count variable is the maximum of connections permitted for the host specified by the host-address variable.

Recommended Action    Use the show static and show nat commands to check the limit imposed on connections to an address. The limit is configurable.

Error Message    %FWSM-6-302001: Built inbound|outbound TCP connection id for faddr 
faddr/fport gaddr gaddr/gport laddr laddr/lport (username)

Explanation    Explanation This is a connection-related message. This message reports that an authenticated inbound or outbound TCP connection was started to foreign address faddr using the global address gaddr from local address laddr. If the connection required authentication, the username is reported in the last field of the message.

Recommended Action    None required.

Error Message    %FWSM-6-302002: Teardown TCP connection id for 
interface:real-address/real-port to interface:real-address/real-port duration 
hh:mm:ss bytes bytes [reason] [(user)]

Explanation    A TCP connection between two hosts was deleted.

connection id is an unique identifier.

interface, real-address, real-port identify the actual sockets.

duration is the lifetime of the connection.

bytes bytes is the data transfer of the connection.

user is the AAA name of the user.

The reason variable presents the action that causes the connection to terminate. Set the reason variable to one of the TCP termination reasons listed in Table 0-3.

Table 0-3 TCP Termination Reasons

Reason
Description

Reset-I

Reset was from the inside.

Reset-O

Reset was from the outside.

TCP FINs

Normal close down sequence.

FIN Timeout

Force termination after 15 seconds awaiting last ACK

SYN Timeout

Force termination after two minutes awaiting three-way handshake completion.

Xlate Clear

Command-line removal.

Deny

Terminate by application inspection.

SYN Control

Back channel initiation from wrong side.

Uauth Deny

Deny by URL filter.

Unknown

Catch-all error.


Recommended Action    None required.

Error Message    %FWSM-6-302009: Rebuilt TCP connection id for faddr faddr/fport gaddr 
gaddr/gport laddr laddr/lport

Explanation    This message appears after a TCP connection is rebuilt after a failover. A sync packet is not sent to the other module. The faddr IP address is the foreign host, the gaddr IP address is a global address on the lower security level interface, and the laddr IP address is the local IP address behind the module on the higher security level interface.

Recommended Action    None required.

Error Message    %FWSM-6-302010: conns in use, conns most used

Explanation    This message appears after a TCP connection restarts. conns is the number of connections.

Recommended Action    None required.

Error Message    %FWSM-7-302013: Built {inbound|outbound} TCP connection id for 
interface:real-address/real-port (mapped-address/mapped-port) to 
interface:real-address/real-port (mapped-address/mapped-port) [(user)]

Explanation    A TCP connection slot between two hosts was created. If inbound is specified, then the original control connection was initiated from the outside.

Recommended Action    None required.

Error Message    %FWSM-5-500003: Bad TCP hdr length (hdrlen=bytes, pktlen=bytes) from 
src_addr/sport to dest_addr/dport, flags: tcp_flags, on interface int_name

Explanation    This message indicates that a header length in TCP is incorrect. Some operating systems do not handle TCP RSTs (resets) correctly when responding to a connection request to a disabled socket. If a client tries to connect to an FTP server outside the module and FTP is not listening, then the server sends an RST. Some operating systems send incorrect TCP header lengths, which causes this problem. UDP uses ICMP port unreachable messages.

The TCP header length may indicate that it is larger than the packet length resulting in a negative number of bytes being transferred. A negative number is displayed by syslog as an unsigned number making it appear far larger than would be normal; for example, showing 4 GB transferred in 1 second.

Recommended Action    None required. This message should occur infrequently.

UDP

Error Message    %FWSM-2-106006: Deny inbound UDP from faddr/fport to laddr/lport on 
interface int_name.

Explanation    This message indicates that an inbound UDP packet is denied by your security policy.

Recommended Action    None required.

Error Message    %FWSM-2-106007: Deny inbound UDP from faddr/fport to laddr/lport due 
to DNS flag.

Explanation    This message indicates that a UDP packet containing a DNS query or response is denied. The flag variable is either Response or Query.

Recommended Action    If the inside port number is 53, the inside host probably is set up as a caching name server. Add an access-list command statement to permit traffic on UDP port 53. If the outside port number is 53, a DNS server was probably too slow to respond, and the query was answered by another server.

Error Message    %FWSM-7-302015: Built {inbound|outbound} UDP connection id for 
interface:real-address/real-port (mapped-address/mapped-port) to 
interface:real-address/real-port (mapped-address/mapped-port) [(user)]

Explanation    A UDP connection slot between two hosts was deleted. If inbound is specified, then the original control connection is initiated from the outside.

Recommended Action    None required.

Error Message    %FWSM-7-302016: Teardown UDP connection id for 
interface:real-address/real-port to interface:real-address/real-port duration 
hh:mm:ss bytes bytes [(user)]

Explanation    A UDP connection slot between two hosts was deleted.

Recommended Action    None required.

SSH

Error Message    %FWSM-3-315001: Denied SSH session from IP_addr on interface int_name

Explanation    This message indicates that the module denies an attempt to connect to the SSH port from the specified IP address on the specified network interface.

Recommended Action    From the console, enter the show ssh command to verify that the module is configured to permit SSH access from the host or network.

Error Message    %FWSM-6-315002: Permitted SSH session from IP_addr on interface 
int_name for user "user_id"

Explanation    This message indicates that an SSH session starts. The ip_addr is the address of the host with the SSH client. The int_name is the interface through which the SSH session is started. The user_ID is the username to which the client is accessing. Use the ssh show sessions command to view the status of SSH sessions.

Explanation    None required.

Error Message    %FWSM-6-315003: SSH login session failed from IP_addr on (num attempts) 
on interface int_name by user "user_id"

Explanation    This message appears after an incorrect user ID or password were entered a certain number of times for the same connection. Up to three attempts are allowed to log into a SSH console session. The ip_addr is the address of the host with the SSH client. The int_name, is the interface through which the SSH session is started. The user_ID is the username that the client is attempting to access.

Recommended Action    If this message appears infrequently, no action is required. If this message appears frequently, it can indicate an attack. Inform the user to verify their username and password.

Error Message    %FWSM-3-315004: Fail to establish SSH session because FWSM RSA host 
key retrieval failed.

Explanation    This message indicates that the module cannot find the module's RSA host key, which is required for establishing an SSH session. The firewall host key may be absent because no module host key has been generated or because the license for this module does not allow DES or 3DES.

Recommended Action    From the console, enter the show ca mypubkey rsa command to verify that module's RSA host key is present. If not, also enter the show version command to check whether the module's license allows DES or 3DES.

Error Message    %FWSM-4-315005: SSH session limit exceeded. Connection request from 
IP_addr on interface int_name

Explanation    This message indicates that the maximum number of SSH connections to the module is exceeded. The module denies any attempt to connect to its SSH port from the specified IP address on the specified network.

Recommended Action    None required.

Error Message    %FWSM-6-315011: SSH session from IP_addr on interface int_name for user 
"user_id" terminated normally
%FWSM-6-315011: SSH session from IP_addr on interface int_name for user "user_id" disconnected by SSH server, reason: "text"

Explanation    This message appears after an SSH session completes. If you enter quit or exit, this message displays terminated normally. If the session disconnected for another reason, the text describes the reason.

Recommended Action    None required.

Telnet

Error Message    %FWSM-6-307001: Denied Telnet login session from IP_addr on interface 
int_name.

Explanation    This message indicates that the module denies an attempt to connect to the Telnet port from the specified IP address on the inside network.

Recommended Action    From the console, enter the show telnet command to verify that the module is configured to permit Telnet access from that host or network.

Error Message    %FWSM-6-307002: Permitted Telnet login session from IP_addr

Explanation    This message logs a successful Telnet connection to the module.

Recommended Action    None required.

Error Message    %FWSM-6-307003: telnet login session failed from IP_addr (num 
attempts) on interface int_name.

Explanation    This message indicates that an incorrect Telnet password was entered a number of times for the same connection. Up to three attempts are allowed to log into a console Telnet session.

Recommended Action    Verify the password and try again.

AAA and ACL

Error Message    %FWSM-4-106019: IP packet from src_addr to dest_addr, protocol 
protocol received from interface int_name deny by access-group acl_ID

Explanation    This message indicates that an IP packet is denied by the parameters you specified.

Recommended Action    None required.

Error Message    %FWSM-6-109001: Auth start for user `username' from laddr/lport to 
faddr/fport

Explanation    This message indicates that the module is configured for AAA and detects an authentication request by the specified user.

Recommended Action    None required.

Error Message    %FWSM-6-109002: Auth from laddr/lport to faddr/fport failed (server 
IP_addr failed) on interface int_name.

Explanation    This message indicates that an authentication request fails because the specified authentication server cannot be contacted by the module.

Recommended Action    Check to be sure the authentication daemon is running on the specified authentication server.

Error Message    %FWSM-6-109003: Auth from laddr to faddr/fport failed (all servers 
failed) on interface int_name.

Explanation    This message indicates that no authentication server can be found.

Recommended Action    Ping the authentication servers from the module. Make sure the daemons are running.

Error Message    %FWSM-6-109005: Authentication succeeded for user `user' from 
laddr/lport to faddr/fport on interface int_name.

Explanation    This message indicates that the specified authentication request succeeds.

Recommended Action    None required.

Error Message    %FWSM-6-109006: Authentication failed for user `user' from laddr/lport 
to faddr/fport on interface int_name.

Explanation    This message indicates that the specified authentication request fails, possibly because of a wrong password.

Recommended Action    None required.

Error Message    %FWSM-6-109007: Authorization permitted for user `user' from 
laddr/lport to faddr/fport on interface int_name.

Explanation    This message indicates that the specified authorization request succeeds.

Recommended Action    None required.

Error Message    %FWSM-6-109008: Authorization denied for user `user' from faddr/fport 
to laddr/lport on interface int_name.

Explanation    This message indicates that you are not authorized to access the specified address, possibly because of a wrong password.

Recommended Action    None required.

Error Message    %FWSM-3-109010: Auth from laddr/lport to faddr/fport failed (too many 
pending auths) on interface int_name.

Explanation    This message indicates that an authentication request cannot be processed because the server has too many requests pending.

Recommended Action    Check to see if the authentication server is too slow to respond to authentication requests. Enable floodguard with the floodguard enable command.

Error Message    %FWSM-2-109011: Authen Session Start: user 'user', sid session_num

Explanation    An authentication session started between the host and the module and has not yet completed.

Recommended Action    None required.

Error Message    %FWSM-5-109012: Authen Session End: user 'user', sid session_num, 
elapsed num seconds

Explanation    The authentication cache has timed out. Users will need to reauthenticate on their next connection. You can change the duration of this timer with the timeout uauth command.

Recommended Action    None required.

Error Message    %FWSM-3-109013: User must authenticate before using this service

Explanation    The user must be authenticated before using the service.

Recommended Action    Authenticate using FTP, Telnet, or HTTP before using the service.

Error Message    %FWSM-6-109015: Authorization denied (acl=acl_ID) for user 'username' 
from src_addr/src_port to dest_addr/dest_port on interface int_name

Explanation    The access list check failed; either it matched a deny, or it matched nothing, such as an implicit deny. The connection was denied by the user access list, which was defined per the AAA authorization policy on Cisco Secure ACS.

Recommended Action    None required.

Error Message    %FWSM-3-109016: Downloaded authorization access-list acl_ID not found 
for user 'username'

Explanation    The AAA authorization access-list command statement ID defined on the remote AAA server has not been configured on the module. This error can occur if you configure the AAA server before configuring the module.

Recommended Action    Use the same access-list command statement ID on the module as you specified on the AAA server.

Error Message    %FWSM-3-302302: ACL = deny; no sa created

Explanation    Proxy mismatches. Proxy hosts for the negotiated SA correspond to a deny access-list command policy.

Recommended Action    Check the access-list command statement in the configuration. Contact the administrator for the peer.

Error Message    %FWSM-7-701001: alloc_user() out of Tcp_user objects

Explanation    This message indicates that the user authentication rate is too high for the module to handle new AAA requests.

Recommended Action    Enable floodguard with the floodguard enable command.

Error Message    %FWSM-4-106023: Deny protocol src [inbound-interface]:[src_address / 
src_port] dst outbound-interface:dst_address / dst_port [type {type}, code {code}] 
by access_group access-list-name

Explanation    An IP packet was denied by the access list.

Recommended Action    Change permission of access list if a permit policy is desired. If messages persist from the same source address, messages could indicate a foot-printing or port-scanning attempt. Contact the remote host administrator.

Error Message    %FWSM-6-610101: Authorization failed: Cmd: cmd_string Cmdtype: 
command_modifier

Explanation    Command authorization failed for the specified command.

Recommended Action    None required.

Error Message    %FWSM-6-611101: User authentication succeeded: Uname: username

Explanation    User authentication when accessing the module succeeded.

Recommended Action    None required.

Error Message    %FWSM-6-611102: User authentication failed: Uname: username

Explanation    User authentication failed when attempting to access the module.

Recommended Action    None required.

Error Message    %FWSM-5-611103: User logged out: Uname: username

Explanation    The specified user logged out.

Recommended Action    None required.

User Management

Error Message    %FWSM-5-111008: User 'user' executed the 'cmd' command.

Explanation    This message indicates that a command change to the configuration has been made.

Recommended Action    None required.

Error Message    %FWSM-5-501101: User transitioning priv level

Explanation    The privilege level of a command was changed.

Recommended Action    None required.

Error Message    %FWSM-5-502101: New user added to local dbase: Uname: username Priv: 
priv_lvl Encpass: encrypted_paswd

Explanation    A new user was added to the local database.

Recommended Action    None required.

Error Message    %FWSM-5-502102: User deleted from local dbase: Uname: username Priv: 
priv_lvl Encpass: encrypted_paswd

Explanation    A user was deleted from the local database.

Recommended Action    None required.

Error Message    %FWSM-5-502103: User priv level changed: Uname: username From: 
old_priv_lvl To: new_priv_lvl 

Explanation    The privilege level you changed.

Recommended Action    None required.

Configuration

Error Message    %FWSM-5-111001: Begin configuration: IP_addr writing to device

Explanation    This message indicates that you entered the write command to store your configuration on a device (either floppy, Flash memory, TFTP, the failover standby module, or the console terminal). The IP address indicates whether the login was made at the console port through Telnet connection.

Recommended Action    None required.

Error Message    %FWSM-6-199005: FWSM Startup begin

Explanation    This message indicates that the module starts up.

Recommended Action    None required.

Error Message    %FWSM-1-709003: (Primary) Beginning configuration replication: 
Receiving from mate.

Explanation    This message indicates that the active module starts replicating its configuration to the standby module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-709004: (Primary) End Configuration Replication (ACT)

Explanation    This message indicates that the active module completes replicating its configuration on the standby module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-709005: (Primary) Beginning configuration replication: 
Receiving from mate.

Explanation    This message indicates that the standby module received the first part of the configuration replication from the active module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-1-709006: (Primary) End Configuration Replication (STB)

Explanation    This message indicates that the standby module completes replicating a configuration sent by the active module. (Primary) can also be listed as (Secondary) for the secondary module.

Recommended Action    None required.

Error Message    %FWSM-2-709007: Configuration replication failed for command 
command_name

Explanation    This message indicates that the standby module cannot complete replicating a configuration sent by the active module. The command that caused the failure displays at the end of the message.

Recommended Action    Write down the command name and contact customer technical support.

FWSM Management

Error Message    %FWSM-5-111003: IP_addr Erase configuration

Explanation    This message indicates that you erased the contents of Flash memory, either by entering the write erase command at the console, or by clicking OK to clear Flash memory. The IP address indicates whether the login was made at the console port through Telnet connection.

Recommended Action    After erasing the configuration, you must reconfigure the module and save the new configuration. Alternatively, you can restore information from a configuration that was previously saved, either on floppy or on a TFTP server elsewhere on the network.

Error Message    %FWSM-5-111004: IP_addr end configuration: [FAILED]|[OK]

Explanation    This message indicates that you entered the config floppy/memory/ network command or the write floppy/memory/network/standby command. The IP_addr indicates whether the login was made at the console port through Telnet connection.

Recommended Action    No action is required if the message ends with OK. If the message indicates a failure, try to fix the problem. For example, if writing to a floppy, ensure that the floppy is not write protected; if writing to a TFTP server, ensure that the server is up.

Error Message    %FWSM-5-111005: IP_addr end configuration: OK

Explanation    This message indicates that you exited configuration mode. The IP address indicates whether the login was made at the console port through Telnet connection.

Recommended Action    None required.

Error Message    %FWSM-5-111006: Console Login from user at IP_addr

Explanation    This message indicates that you connected to the module. If authentication is enabled, the username is reported; otherwise, the string nobody appears. The IP address indicates whether the login was made at the console port through Telnet connection.

Recommended Action    None required.

Error Message    %FWSM-5-111007: Begin configuration: IP_addr reading from device.

Explanation    This message indicates that you enter the reload or configure command to read in a configuration. The device text can be floppy, memory, net, standby, or terminal. The IP address indicates whether the login was made at the console port through Telnet connection.

Recommended Action    None required.

Error Message    %FWSM-7-111009:User user_name executed cmd:command

Explanation    This syslog message is for accounting purposes. You entered a command that does not modify the configuration.

Recommended Action    None required.

Error Message    %FWSM-2-112001:FWSM clear finished.

Explanation    This message indicates that a request to clear the module configuration has finished. The source file and line number are identified.

Recommended Action    None required.

Error Message    %FWSM-5-199001: FWSM reload command executed from IP_addr.

Explanation    This message indicates the address of the host initiating a module reboot with the reload command.

Recommended Action    None required.

Error Message    %FWSM-6-199002: FWSM startup completed. Beginning operation.

Explanation    This message indicates that after the module finishes its initial boot and Flash memory reading sequence, and is ready to begin operating normally.

Recommended Action    None required.

Error Message    %FWSM-6-307002: Permitted Telnet login session from IP_addr

Explanation    This message indicates a successful Telnet connection to the module.

Recommended Action    None required.

Error Message    %FWSM-6-307003: telnet login session failed from IP_addr (num 
attempts) on interface int_name.

Explanation    This message indicates that an incorrect Telnet password was entered a number of times for the same connection. Up to three attempts are allowed to log into a console Telnet session.

Recommended Action    Verify the password and try again.

Error Message    %FWSM-6-308001: FWSM console enable password incorrect for num tries 
(from IP_addr).

Explanation    This message indicates the number of times you incorrectly typed the password to enter privileged mode. The maximum is three attempts.

Recommended Action    The privileged mode password is not necessarily the same as the password for Telnet access to the module. Verify the password and try again.

Error Message    %FWSM-3-309001: Denied manager connection from IP_addr.

Explanation    This message indicates that the Firewall Manager denies an attempt to connect to its Telnet port from the specified IP address on the inside network.

Recommended Action    None required.

Error Message    %FWSM-6-309002: Permitted manager connection from IP_addr.

Explanation    This message indicates a successful connection.

Recommended Action    None required.

Error Message    %FWSM-4-309004: Manager session limit exceeded. Connection request 
from IP_addr on interface int_name

Explanation    This message indicates that the maximum number of module management connections has been exceeded. The module denies an attempt to connect to its management port from the specified IP address on the specified network.

Recommended Action    None required.

PDM

Error Message    %FWSM-6-606001: PDM session number num from IP_addr started

Explanation    This message indicates that a PDM session has been started.

Recommended Action    None required.

Error Message    %FWSM-6-606002: PDM session number num from IP_addr ended

Explanation    This message indicates that a PDM session has ended.

Recommended Action    None required.

Stateful Failover

Error Message    %FWSM-3-210001: LU SW_Module_Name error = error_code

Explanation    This message indicates that a stateful failover error occurred.

Recommended Action    If this error persists after traffic lessens through the module, report this error to customer support.

Error Message    %FWSM-3-210002: LU allocate block (size) failed.

Explanation    Stateful failover could not allocate a block of memory to transmit stateful information to the standby module.

Recommended Action    Check the failover interface to make sure its transmit is normal using the show interface command. Also, check the current block of memory using the show block command. If current available count is 0 within any of the blocks of memory, then reload the module software to recover the lost blocks of memory.

Error Message    %FWSM-3-210003: Unknown LU Object ID

Explanation    Stateful failover received an unsupported Logical Update object and was unable to process it. This situation could be caused by corrupted memory, LAN transmissions, and other events.

Recommended Action    If you see this error infrequently, then no action is required. If this error occurs frequently, check the stateful failover link LAN connection. If the error was not caused by a faulty failover link LAN connection, determine if an external user is trying to compromise the protected network. Check for incorrectly configured clients.

Error Message    %FWSM-3-210005: LU allocate connection failed

Explanation    Stateful failover cannot allocate a new connection on the standby module. This may be caused by little or no RAM memory available within the module.

Recommended Action    Check the available memory using the show mem command to make sure the module has free memory in the system. If there is no available memory, add more physical memory to the module.

Error Message    %FWSM-3-210006: LU look NAT for IP_addr failed

Explanation    Stateful failover was unable to locate an NAT group for the IP address on the standby module. The active and standby modules probably are out of synchronization.

Recommended Action    Enter the write standby command on the active module to synchronize system memory with the standby module.

Error Message    %FWSM-3-210007: LU allocate xlate failed

Explanation    Stateful failover failed to allocate an translation slot (xlate) record.

Recommended Action    Check the available memory using the show mem command to make sure that the module has free memory in the system. If the memory has been used up, you may need to add more physical memory.

Error Message    %FWSM-3-210008: LU no xlate for laddr/l_port faddr/f_port

Explanation    Unable to find an translation slot (xlate) record for a stateful failover connection; unable to process the connection information.

Recommended Action    Enter the write standby command on the active module to synchronize system memory between the active and standby modules.

Error Message    %FWSM-3-210010: LU make UDP connection for faddr:f_port laddr:l_port 
failed

Explanation    Stateful failover was unable to allocate a new record for a UDP connection.

Recommended Action    Check the available memory with the show memory command to make sure that the module has free memory in the system. If the memory has been used up, you may need to add more physical memory.

Error Message    %FWSM-3-210020: LU PAT port port_number reserve failed

Explanation    Stateful failover is unable to allocate a specific PAT address which is in use.

Recommended Action    If this error reappears frequently, enter the write standby command on the active module to synchronize system memory between the active and standby modules.

Error Message    %FWSM-3-210021: LU create static xlate global_IP ifc int_name failed

Explanation    Stateful failover is unable to create a translation slot (xlate).

Recommended Action    If this error reappears frequently, use the write standby command on the active module to synchronize system memory between the active and standby modules.

Error Message    %FWSM-6-210022: LU missed number updates

Explanation    Stateful failover assigns a sequence number for each record sent to the standby module. When a received record sequence number is out of sequence with the last updated record, the information in between is assumed lost and this error message is sent.

Recommended Action    Unless there are LAN interruptions, check the available memory on both modules to ensure there is enough memory to process the stateful information. Use the show failover command to monitor the quality of stateful information updates.

Error Message    %FWSM-6-311001: LU loading standby start

Explanation    This message indicates that stateful failover update information was sent to the standby module.

Recommended Action    None required.

Error Message    %FWSM-6-311002: LU loading standby end

Explanation    This message indicates that stateful failover update information is done being sent to the standby module.

Recommended Action    None required.

Error Message    %FWSM-6-311003: LU recv thread up

Explanation    This message indicates that an update acknowledgment has been received from the standby module.

Recommended Action    None required.

Error Message    %FWSM-6-311004: LU xmit thread up

Explanation    This message indicates that a stateful failover update is transmitted to the standby module.

Recommended Action    None required.

Memory and Resource Allocation

This section contains the messages generated by memory and resources.

Error Message    %FWSM-3-211001: Memory allocation Error

Explanation    Failed to allocate RAM system memory.

Recommended Action    If this message occurs periodically, it can be ignored. If it repeats frequently, contact customer technical support.

Error Message    %FWSM-2-211003: CPU Utilization for number_seconds seconds = 
cpu_utilization

Explanation    CPU utilization exceeds 100 percent. The utilization time in seconds (number_seconds) and the percentage of CPU usage (cpu_utilization). This is a value greater than 100 percent.

Recommended Action    Report this error to customer technical support.

SNMP

This section contains the messages generated by SNMP.

Error Message    %FWSM-3-212001: Unable to open SNMP channel (UDP port udp_port) on 
interface interface_name, error code = code

Explanation    This message indicates that the module cannot receive SNMP requests destined for the module from SNMP management stations located on this interface. This does not affect the SNMP traffic passing through the module through any interface.

Recommended Action    An error code of -1 indicates that the module could not open the SNMP transport for the interface, and once the module reclaims some of its resources when traffic is lighter, use the snmp-server host command for that interface again.

Error Message    %FWSM-3-212002: Unable to open SNMP trap channel (UDP port udp_port) 
on interface interface_name, error code = code

Explanation    This message indicates that the module will not be able to send its SNMP traps from the module to SNMP management stations located on this interface. This does not affect the SNMP traffic passing through the module through any interface.

An error code of -1 indicates that module could not open the SNMP trap transport for the interface An error code of -2 indicates that module could not bind the SNMP trap transport for the interface.

Recommended Action    After the module reclaims some of its resources when traffic is lighter, enter the snmp-server host command for that interface again.

Error Message    %FWSM-3-212003: Unable to receive an SNMP request on interface 
interface_name, error code = code, will try again.

Explanation    This message indicates that of an internal error for an interface was received.

Recommended Action    None required. The module SNMP agent will wait for the next SNMP request.

Error Message    %FWSM-3-212004: Unable to send an SNMP response to IP Address IP_addr 
Port port interface interface_name, error code = code

Explanation    This message indicates that of an internal error occurred in sending an SNMP response from the module to the specified host on the specified interface.

Recommended Action    None required.

Error Message    %FWSM-3-212005: incoming SNMP request (number bytes) on interface 
int_name exceeds data buffer size, discarding this SNMP request.

Explanation    This message indicates that the length of the incoming SNMP request, which is destined for the module, exceeds the size of the internal data buffer (512 bytes) used for storing the request during internal processing; therefore, the module cannot process this request. This does not affect the SNMP traffic passing through the module through any interface.

Recommended Action    Configure the SNMP management station to resend the request with a shorter length, for example, instead of querying multiple MIB variables in one request, try querying only one MIB variable in a request. You may need to modify the configuration of the SNMP manager software.

DHCP

Error Message    %FWSM-6-604103: DHCP daemon interface int_name: address granted 
MAC_addr (IP_addr)

Explanation    The module DHCP server granted an IP address to an external client.

Recommended Action    None required.

Error Message    %FWSM-6-604104: DHCP daemon interface int_name: address released

Explanation    An external client released an IP address back to the module DHCP server.

Recommended Action    None required.

VPN

Error Message    %FWSM-4-402101: decaps: rec'd IPSEC packet has invalid spi for 
destaddr=IP_addr, prot=protocol, spi=spi 

Explanation    Received an IPSec packet that specifies that the SPI does not exist in the server address database. This situation may be a temporary condition due to slight differences in aging of server addresses between the IPSec peers, or it may be because the local server addresses have been cleared. It may also be because of incorrect packets sent by the IPSec peer. This message might also indicate an attack.

Recommended Action    The peer may not acknowledge that the local SAs have been cleared. If a new connection is established from the local router, the two peers may then reestablish successfully. Otherwise, if the problem occurs for more than a brief period, either attempt to establish a new connection or contact the peer's administrator.

Error Message    %FWSM-4-402102: decapsulate: packet missing packet_type, 
destadr=dest_addr, actual prot=protocol 

Explanation    Received IPSec packet is missing an expected AH or ESP header. The peer is sending packets that do not match the negotiated security policy. This may be an attack. The packet type is either AH or ESP.

Recommended Action    Contact the peer's administrator.

Error Message    %FWSM-4-402103: identity doesn't match negotiated identity (ip) 
dest_addr= IP_addr, src_addr= IP_addr, prot= protocol, (ident) local=IP_addr, 
remote=IP_addr, local_proxy=IP_addr/IP_addr/port/port, 
remote_proxy=IP_addr/IP_addr/port/port

Explanation    An unencapsulated IPSec packet does not match the negotiated identity. The peer is sending other traffic through this security association. This situation may be due to a security association selection error by the peer. This situation may be a hostile event.

Recommended Action    Contact the peer's administrator to compare policy settings.

Error Message    %FWSM-4-402106: Rec'd packet not an IPSEC packet (ip) dest_addr= 
IP_addr, src_addr= IP_addr, prot= protocol

Explanation    Received packet matched the crypto map ACL, but it is not IPSec-encapsulated. IPSec Peer is sending unencapsulated packets. This situation may occur because of a policy setup error on the peer. This may also be a hostile event.

Recommended Action    Contact the peer's administrator to compare policy settings.

Error Message    %FWSM-4-404101: ISAKMP: Failed to allocate address for client from pool 
pool_id

Explanation    The Internet Security Association and Key Management Protocol (ISAKMP), failed to allocate an IP address for the VPN client from the pool you specified with the ip local pool command.

Recommended Action    Enter the ip local pool command to specify additional IP addresses for the pool.

Error Message    %FWSM-6-602102: Adjusting IPSec tunnel mtu

Explanation    The MTU for an IPSec tunnel is adjusted from path MTU discovery.

Recommended Action    Check the MTU of the IPSec tunnels. If an affected MTU is smaller than normal, check intermediate links.

Error Message    %FWSM-6-602301: sa created 

Explanation    A new security association was created.

Recommended Action    Informational message only.

Error Message    %FWSM-6-602302: deleting sa

Explanation    A security association was deleted.

Recommended Action    Informational message only.

Error Message    %FWSM-7-702301: lifetime expiring 

Explanation    A security association lifetime has expired.

Recommended Action    Debugging message only.

Error Message    %FWSM-7-702303: sa_request

Explanation    IPSec has requested internet key exchange (IKE) for new security associations.

Recommended Action    Debugging message only.

Internet Protocol Routing

Error Message    %FWSM-1-106012: Deny IP from IP_address to IP_address, IP options hex.

Explanation    This is a packet integrity check message. An IP packet was seen with IP options. Because IP options are considered a security risk, the packet was discarded.

Contact the remote host system administrator to determine the problem. Check the local site for loose source routing or strict source routing.

Error Message    %FWSM-3-317001: No memory available for limit_slow

Explanation    The requested operation failed because of a low memory condition.

Recommended Action    Reduce other system activity to ease memory demands. If conditions warrant, upgrade to a larger memory configuration.

Error Message    %FWSM-3-317003: IP routing table creation failure - reason

Explanation    An internal software error occurred, which prevented the creation of new IP routing table.

Recommended Action    Copy the message exactly as it appears, and report it to your technical support representative.

Error Message    %FWSM-3-317004: IP routing table limit warning

Explanation    The number of routes in the named IP routing table has reached the configured warning limit.

Recommended Action    Reduce the number of routes in the table.

Error Message    %FWSM-3-317005: IP routing table limit exceeded - reason, ip_address 
ip_mask

Explanation    Further routes will be added to the table.

Recommended Action    Reduce the number of routes in the table, or reconfigure the limit.

Error Message    %FWSM-4-408001: IP route counter negative - reason, ip_address  
Attempt: number

Explanation    Attempt to decrement IP route counter into negative value failed.

Recommended Action    Enter the clear ip route * command to reset the route counter. If the message continues to appear consistently, copy the messages exactly as they appear, and report it to your technical support representative.

OSPF

Error Message    %FWSM-3-318002: Flagged as being an ABR without a backbone area

Explanation    The router was flagged as an area border router without a backbone area configured in the router.

Recommended Action    Restart the OSPF process.

Error Message    %FWSM-6-613001: Checksum Failure in database in area ospf_complain 
Link State Id ip_address Old Checksum old_checksum New Checksum new_checksum

Explanation    OSPF has detected a checksum error in the database due to memory corruption.

Recommended Action    Restart the OSPF process.

Error Message    %FWSM-4-409001: Database scanner: external LSA ip_address ip_mask is 
lost, reinstalls

Explanation    The software detected an unexpected condition. The router will take corrective action and continue.

Recommended Action    None required.

Error Message    %FWSM-4-409002: db_free: external LSA ip_address ip_mask

Explanation    An internal software error occurred.

Recommended Action    None required.

Error Message    %FWSM-4-409003: Received invalid packet: reason from ip_address, 
int_name

Explanation    An invalid OSPF packet was received. Details are included in the error message. The cause might be a incorrect OSPF configuration or an internal error in the sender.

Recommended Action    Check the OSPF configuration of the receiver and the sender configuration for inconsistency.

Error Message    %FWSM-3-318003: Reached unknown state in neighbor state machine

Explanation    An internal software error occurred.

Recommended Action    None required.

Error Message    %FWSM-4-409004: Received reason from unknown neighbor ip_address

Explanation    The OSPF hello, database description, or database request packet was received, but the router could not identify the sender.

Recommended Action    This situation should correct itself.

Error Message    %FWSM-4-409005: Invalid length number in OSPF packet from ip_address 
(ID ip_address), int_name

Explanation    The system received an OSPF packet with a filed length of less than normal header size or inconsistent with the size of the IP packet in which it arrived. This indicates a configuration error in the sender of the packet.

Recommended Action    From a neighboring address, locate the problem router and reboot it.

Error Message    %FWSM-4-409006: Invalid lsa: reason Type number, LSID ip_address from 
ip_address, ip_address, int_name

Explanation    The router received an LSA with an invalid LSA type. The cause is either memory corruption or unexpected behavior on a router.

Recommended Action    From a neighboring address, locate the problem router and reboot it. To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-4-409007: Found LSA with the same host bit set but using 
different mask LSA ID ip_address ip_mask New: Destination ip_address ip_mask

Explanation    An internal software error occurred

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-4-409008: Found generating default LSA with non-zero mask LSA 
type : number Mask : ip_address metric : number area : name

Explanation    The router tried to generate a default LSA with the wrong mask and possibly wrong metric due to an internal software error

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-4-409009: OSPF process number cannot start. There must be at 
least one \up\ IP interface, for OSPF to use as router ID

Explanation    OSPF failed while attempting to allocate a router ID from the IP address of one of its interfaces.

Recommended Action    Make sure that there is at least one interface that is up and has a valid IP address. If there are multiple OSPF processes running on the router, each requires a unique router ID. You must have enough interfaces up so that each of them can obtain a router ID.

Error Message    %FWSM-4-409010: Virtual link information found in non-backbone area: 
area_name

Explanation    An internal error occurred.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-3-318004: area area_name lsid ip_address mask ip_address adv 
ip_address type number

Explanation    OSPF has a problem locating the LSA, which could lead to a memory leak.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-3-318005: lsid ip_address adv ip_address type number gateway 
ip_address metric number network ip_address mask ip_address protocol number attr 
number net-metric number

Explanation    OSPF has a problem locating the LSA.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    OSPF found inconsistency between its database and IP routing table

Explanation    An internal error occurred.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-6-613002: interface interface_name has zero bandwidth

Explanation    The interface reports its bandwidth as zero.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-3-318006: if string if_state number

Explanation    An internal error occurred.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-5-503001: Process number, Nbr ip_address on int_name from name 
to name, reason

Explanation    An OSPF neighbor has changed its state. The message describes the change and the reason for it. This message appears only if the log-adjacency-changes command is configured for the OSPF process.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-6-613003: ip_address ip_mask changed from area areaname to area 
areaname

Explanation    An OSPF configuration change has caused a network range to change areas

Recommended Action    Reconfigure OSPF with the correct network range.

Error Message    %FWSM-3-318007: OSPF is enabled on string during idb initialization

Explanation    An internal error occurred.

Recommended Action    To determine what is causing this problem, contact your Cisco technical support representative for assistance.

Error Message    %FWSM-4-409011: OSPF detected duplicate router-id ip_address from 
ip_address on interface interface_name

Explanation    OSPF received a hello packet from a neighbor that has the same router ID as this routing process. A full adjacency cannot be established.

Recommended Action    OSPF router ID should be unique. Change the neighbors router ID.

Error Message    %FWSM-4-409012: Detected router with duplicate router ID ip_address in 
area area_name

Explanation    OSPF received a hello packet from a neighbor that has the same router ID as this routing process. A full adjacency cannot be established.

Recommended Action    OSPF router ID should be unique. Change the neighbors router ID.

Error Message    %FWSM-4-409013: Detected router with duplicate router ID ip_address in 
Type-4 LSA advertised by ip_address 

Explanation    OSPF received a hello packet from a neighbor that has the same router ID as this routing process. A full adjacency cannot be established.

Recommended Action    OSPF router ID should be unique. Change the neighbors router ID.

Error Message    %FWSM-3-318008: OSPF process number is changing router-id. Reconfigure 
virtual link neighbors with our new router-id

Explanation    OSPF process is being reset, and it is going to select a new router ID, which will bring down all virtual links. To make the links work again, the virtual link configuration needs to be changed on all virtual link neighbors.

Recommended Action    Change virtual link configuration on all the virtual link neighbors, to reflect our new router ID.

Error Message    %FWSM-3-319001: Acknowledge for arp update for IP address dest_addr 
not received (number).

Explanation    The ARP process in the Firewall Services Module lost internal synchronization because the system was overloaded.

Recommended Action    No immediate action is required. The failure is only temporary. Check the average load of the system and make sure it is not used beyond its capabilities.

Error Message    %FWSM-3-319002: Acknowledge for route update for IP address dest_addr 
not received (number).

Explanation    The routing module in The Firewall Services Module lost internal synchronization because the system was overloaded.

Recommended Action    No immediate action required. The failure is only temporary. Check the average load of the system and make sure it is not used beyond its capabilities.

Error Message    %FWSM-3-319003: Arp update for IP address dest_addr failed (number).

Explanation    The ARP module in the Firewall Services Module lost internal synchronization because the system was overloaded.

Recommended Action    No immediate action required. The failure is only temporary. Check the average load of the system and make sure it is not used beyond its capabilities.

Error Message    %FWSM-3-319004: Route update for IP address dest_addr failed (number).

Explanation    The routing module in The Firewall Services Module lost internal synchronization because the system was overloaded.

Recommended Action    No immediate action required. The failure is only temporary. Check the average load of the system and make sure it is not used beyond its capabilities.

Shun

Error Message    %FWSM-4-401001: Shuns cleared

Explanation    The clear shun command was entered to remove existing shuns from memory.

Recommended Action    None required. This message provides a record of shunning activity.

Error Message    %FWSM-4-401002: Shun added: IP_addr IP_addr port port

Explanation    A shun command was entered, where the first IP address is the shunned host. The other addresses and ports are optional and are used to terminate the connection if available.

Recommended Action    None required. This message provides a record of shunning activity.

Error Message    %FWSM-4-401003: Shun deleted: IP_addr

Explanation    A single shunned host was removed from the shun database.

Recommended Action    None required. This message provides a record of shunning activity.

Error Message    %FWSM-4-401004: Shunned packet: IP_addr ==> IP_addr on interface 
int_name

Explanation    A packet was dropped because the host defined by IP source is a host in the shun database. A shunned host cannot pass traffic on the interface on which it is shunned. For example, an external host on the Internet can be shunned on the outside interface.

Recommended Action    None required. This message provides a record of the shunned hosts activity. This message and the next message (%FWSM-4-401005) can be used to evaluate further risk assessment concerning this host.

Error Message    %FWSM-4-401005: Shun add failed: unable to allocate resources for 
IP_addr IP_addr port port

Explanation    The module is out of memory; a shun could not be applied.

Recommended Action    The Cisco Secure Intrusion Detection System should continue to attempt to apply this rule. Attempt to reclaim memory and reapply shun manually, or wait for the Cisco Secure Intrusion Detection System to do this process.