Table Of Contents
System Messages
System Log Messages
System Message Log Differences
Failover Messages
Connection Messages
FTP and URL
HTTP
ICMP
Routing Messages
H.225
H.245
H.323
IP Fragmentation
SIP
Skinny
RSH
RTSP
SMTP
TCP
UDP
SSH
Telnet
AAA and ACL
User Management
Configuration
FWSM Management
PDM
Stateful Failover
Memory and Resource Allocation
SNMP
DHCP
VPN
Internet Protocol Routing
OSPF
Shun
System Messages
This appendix provides the list of system log messages supported in the Firewall Services Module. The module functions similarly to the PIX firewall application software. Refer to the System Log Messages for the Cisco Secure PIX Firewall Version 6.0 documentation for information about the system message logs. The messages are listed by type and by message code within each type.
This appendix includes the following sections:
•
System Log Messages
•
System Message Log Differences
•
Failover Messages
•
Connection Messages
•
SSH
•
Telnet
•
AAA and ACL
•
User Management
•
Configuration
•
FWSM Management
•
PDM
•
Stateful Failover
•
Memory and Resource Allocation
•
SNMP
•
DHCP
•
VPN
•
Internet Protocol Routing
•
OSPF
•
Shun
Note
The messages shown in this appendix apply to Firewall Services Module version 1.1(1) and higher. When a number is skipped from a sequence, for example, 106019, the message is no longer in the firewall code.
You can configure the module system software to send these messages to the output location of your choice. For example, you can specify that log messages be sent to the console, to any Telnet session actively connected to the module console, or to a logging server elsewhere on the network.
The module provides three output locations for sending syslog messages: the console, a host running a syslog server, and an SNMP management station. If you send messages to a host, they are sent using either UDP or TCP. The host must have a program (known as a server) called syslogd.
The syslog server runs a Windows NT-based system that accepts TCP and UDP system log messages. The syslog server provides time-stamped syslog messages, accepts messages on alternate ports, and in TCP mode stops the firewall traffic if the server log disk is full or the server goes down.
System Log Messages
System log messages received at a syslog server begin with a percent sign (%) and are structured as follows:
%FWSM-Level-Message_number: Message_text
•
FWSM identifies the message facility code for messages generated by the Firewall Services Module.
•
Level reflects the severity of the condition described by the message. The lower the number, the more severe the condition. Table C-1 lists the severity levels. Logging is set to level 3 (error) by default.
Table C-1 Log Message Security Levels
Level Number
|
Level Keyword
|
Description
|
0
|
emergency
|
System unusable
|
1
|
alert
|
Immediate action needed
|
2
|
critical
|
Critical condition
|
3
|
error
|
Error condition
|
4
|
warning
|
Warning condition
|
5
|
notification
|
Normal but significant condition
|
6
|
informational
|
Informational message only
|
7
|
debugging
|
Appears during debugging only
|
•
Message_number is the numeric code that uniquely identifies the message.
•
Message_text is a text string describing the condition. This portion of the message sometimes includes IP addresses, port numbers, or usernames. Table C-2 lists the variable fields and the type of information in them.
Table C-2 Variable Fields in Syslog Messages
Variable
|
Type of Information
|
chars
|
Text string (for example, a username).
|
dec
|
Decimal number.
|
dest_addr
|
Destination address.
|
faddr
|
Foreign IP address, an address of a host typically on a lower security level interface in a network beyond the outside router.
|
fport
|
Foreign port number.
|
gaddr
|
Global IP address, an address on a lower security level interface.
|
hex
|
Hexadecimal number.
|
interface_name, int_name
|
Interface name.
|
interface_number
|
Use the show nameif command to determine which interface is being described in a message containing this variable. For example:
show nameif
nameif ethernet0 outside security0
nameif ethernet1 inside security100
nameif token0 outside security20
nameif ethernet2 inside security30
In this example, ethernet0 would appear in a syslog message as interface 0, ethernet1 would be interface 1, token0 would be interface 2, and ethernet2 would be interface 3.
|
laddr
|
Local IP address, an address on a higher security level interface.
|
lport
|
Local port number.
|
octal
|
Octal number.
|
ip_addr/ip_address
|
IP address (for example, 192.168.1.2).
|
ip_mask
|
IP mask (for example 255.255.255.0)
|
port
|
Port number.
|
reason
|
Message string
|
return_code
|
Return code.
|
src_addr
|
Source address.
|
time
|
Duration, in the format hh:mm:ss.
|
TCP_flags
|
TCP flag values.
|

Note
Syslog messages received at the module serial console contain only the code portion of the message. When you view the message description the severity level is provided.
System Message Log Differences
The module provides the following differences to the system message logging of the PIX firewall software:
•
Syslog level changes for the module to reduce the number of syslog entries per connection from 4 to 2 at Info(6) level:
–
Portmapped translation built (305001) changed from Info (6) to Debug(7)
–
Translation built (305002) changed from Info (6) to Debug(7)
–
Teardown translation (305003) changed from Info (6) to Debug(7)
–
Teardown portmap translation (305004) changed from Info (6) to Debug(7)
•
Syslog level changes for consistency purposes:
–
PreAllocate H323 UDP Connection (302004) changed from Info(6) to Debug(7)
–
Built H245 Connection (302003) changed from Info (6) to Debug(7)
–
PreAllocate H225 Connection (302012) changed from Info(6) to Debug(7)
–
PreAllocate SIP Secondary Channel (607001) changed from Info(6) to Debug(7)
–
PreAllocate Skinny Secondary Channel (608001) changed from Info(6) to Debug(7)
–
PreAllocate RTSP UDP Connection (314001) changed from Info(6) to Debug(7)
•
Syslog changes for Deny By Access Group (106023) Warning(4):
–
After a threshold has been reached, you can generate syslog only if the connection gets dropped for a specific access control rule n number of times (n is a global configurable item).
–
After a threshold has been reached, you can generate syslog once every t seconds with the ACL rule parameter that is getting hit (t is a global configurable item).
–
Deny Inbound (106010) changed from Error (3) to Info(4).
•
Syslog messages generated by network processes are based on the interface. You can configure the module to either drop a new connection when the threshold is reached through that interface or allow the new connection without generating a syslog message.
Failover Messages
This section contains the messages generated by a failover configuration.
Error Message %FWSM-1-103001: (Primary) No response from other firewall (reason code
= code).
Explanation This message indicates that the primary module is unable to communicate with the
secondary module over the failover cable. (Primary) can also be listed as (Secondary) for the
secondary module.
Recommended Action Verify that the secondary module has the exact same hardware, software version
level, and configuration as the primary module.
Error Message %FWSM-1-103002: (Primary) Other firewall network interface
interface_name OK.
Explanation This message indicates that the primary module detected that the network interface on
the secondary module is acceptable. (Primary) can also be listed as (Secondary) for the secondary
module.
Recommended Action None required.
Error Message %FWSM-1-103003: (Primary) Other firewall network interface
interface_name failed.
Explanation This message indicates that the primary module detects a bad network interface on the
secondary module. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action Check the network connections on the secondary module, and check the
network hub connection. If necessary, replace the failed network interface.
Error Message %FWSM-1-103004: (Primary) Other firewall reports this firewall failed.
Explanation This message indicates that the primary module receives a message from the secondary
module indicating that the primary has failed. (Primary) can also be listed as (Secondary) for the
secondary module.
Recommended Action Verify the status of the primary module.
Error Message %FWSM-1-103005: (Primary) Other firewall reporting failure.
Explanation This message indicates that the secondary module reports a failure to the primary
module. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action Verify the status of the secondary module.
Error Message %FWSM-1-104001: (Primary) Switching to ACTIVE (cause: reason).
%FWSM-1-104002: (Primary) Switching to STNDBY (cause: reason).
Explanation Both instances are failover messages. These messages are logged when you force the
failover module pair to switch roles. You can force the failover module pair to switch roles by either
entering the failover active command on the secondary module or the no failover active command
on the primary module. (Primary) can also be listed as (Secondary) for the secondary module.
Possible values for the reason variable are as follows:
–
State check
–
Bad or incomplete configuration
–
Interface check, mate is healthier
–
The other module wants to be standby
–
In failed state, cannot be active
–
Switch to failed state
Recommended Action If the message occurs because of manual intervention, no action is required.
Otherwise, use the cause reported by the secondary module to verify the status of both modules of
the pair.
Error Message %FWSM-1-104003: (Primary) Switching to FAILED.
Explanation This message indicates that the primary module fails.
Recommended Action Check the system log messages for the primary module for an indication of the
nature of the problem (see message %FWSM-1-104001:). (Primary) can also be listed as (Secondary)
for the secondary module.
Error Message %FWSM-1-104004: (Primary) Switching to OK.
Explanation This message indicates that a previously failed module now reports that it is operating
again. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action None required.
Error Message %FWSM-1-105001: (Primary) Disabling failover.
Explanation This message indicates that you entered the no failover command on the console.
(Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action None required.
Error Message %FWSM-1-105002: (Primary) Enabling failover.
Explanation This message indicates that you entered the failover command with no arguments on the
console, after having previously disabled failover. (Primary) can also be listed as (Secondary) for the
secondary module.
Recommended Action None required.
Error Message %FWSM-1-105003: (Primary) Monitoring on interface int_name waiting
Explanation The firewall is testing the specified network interface with the other module of the
failover pair.
Recommended Action None required. The firewall monitors its network interfaces frequently during
normal operations.
Error Message %FWSM-1-105004: (Primary) Monitoring on interface int_name normal
Explanation The test of the specified network interface was successful. (Primary) can also be listed
as (Secondary) for the secondary module.
Recommended Action None required.
Error Message %FWSM-1-105005: (Primary) Lost Failover communications with mate on
interface int_name.
Explanation This message indicates that this module of the failover pair can no longer communicate
with the other module of the pair. (Primary) can also be listed as (Secondary) for the secondary
module.
Recommended Action Verify that the network connected to the specified interface is functioning
correctly.
Error Message %FWSM-1-105006: (Primary) Link status 'Up' on interface int_name.
%FWSM-1-105007: (Primary) Link status 'Down' on interface int_name.
Explanation Both instances are failover messages. These messages report the results of monitoring
the link status of the specified interface. (Primary) can also be listed as (Secondary) for the secondary
module.
Recommended Action If the link status is down, verify that the network connected to the specified
interface is operating correctly.
Error Message %FWSM-1-105008: (Primary) Testing interface int_name.
Explanation This message indicates that the firewall tested a specified network interface. This testing
is performed only if the firewall fails to receive a message from the standby module on that interface
after the expected interval. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action None required.
Error Message %FWSM-1-105009: (Primary) Testing on interface int_name result.
Recommended Action This message reports the result (either Passed or Failed. Allocation is required
if the result is Passed. If the result is Failed, you should check to be sure the network cable is properly
connected to both failover modules and that the network itself is functioning correctly, and verify the
status of the standby module.
Error Message %FWSM-3-105010: (Primary) Failover message block alloc failed
Explanation Block memory has been depleted. This is a transient message and the firewall should
recover. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action Use the show blocks command to monitor the current block memory.
Error Message %FWSM-1-105011: (Primary) Failover cable communication failure
Explanation The failover cable is not permitting communication between the primary and secondary
modules. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action Ensure that the cable is properly connected.
Error Message %FWSM-1-105020: (Primary) Incomplete/slow config replication
Explanation When a failover occurs, the active firewall detects a partial configuration in memory.
This situation is caused by an interruption in the replication service. (Primary) can also be listed as
(Secondary) for the secondary module.
Recommended Action Once the failover is detected by the firewall, the firewall automatically reloads
itself and loads the configuration from Flash and resynchronizes with another firewall. If failovers
happen continuously, check the failover configuration and make sure both firewalls can communicate
with each other.
Error Message %FWSM-1-105038: (Primary) Interface count mismatch
Explanation Failover initially verifies that the number of interfaces configured on the primary and
secondary modules are the same. This message indicates that after the verification that the numbers
are not the same. Failover cannot be enabled until both primary and secondary modules have the same
number of interfaces. (Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action Check the VLAN configuration on the primary and secondary modules. Check
for any nameif command failure on the primary module. (Primary) can also be listed as (Secondary)
for the secondary module. Once these configurations are verified and corrected, type failover on the
primary module to enable failover again.
Error Message %FWSM-1-105039: (Primary) Unable to verify the Interface count with
mate. Failover may be disabled in mate.
Explanation Failover initially verifies that the number of interfaces configured on the primary and
secondary modules are the same. This message indicates that the primary module is not able to verify
the number interfaces configured on the secondary module. This indicates that the primary module
is not able communicate with the secondary module over the failover interface. (Primary) can also
be listed as (Secondary) for the secondary module.
Recommended Action Verify the failover VLAN, interface configuration and status on the primary and
secondary modules. Make sure the secondary module is running the firewall application and failover
is enabled. (Primary) can also be listed as (Secondary) for the secondary module.
Error Message %FWSM-1-105040: (Primary) Mate failover version is not compatible.
Explanation The primary and secondary module should run the same failover software version to act
as a failover pair. This message indicates that the secondary module's failover software version is not
compatible with the primary module. Failover would be disabled on the primary module. (Primary)
can also be listed as (Secondary) for the secondary module.
Recommended Action Maintain consistent software versions between the primary and secondary
modules to enable failover.
Error Message %FWSM-1-105041: (Primary) nameif command failed. Number of interfaces
is not consistent with mate.
Explanation This message indicates that during a configuration sync from the secondary to the
primary module the nameif command has failed in the primary module. The nameif command,
defines the firewall interfaces in the Firewall Services Module. If this command fails during
synchronization, the result is that the interfaces are inconsistent across the failover modules. To avoid
this situation, failover is disabled. (Primary) can also be listed as (Secondary) for the secondary
module.
Recommended Action Correct the reason why nameif failed, and then enable failover.
Error Message %FWSM-1-105042: (Primary) Failover interface OK
Explanation Interface used to send failover messages to the secondary module is functioning.
(Primary) can also be listed as (Secondary) for the secondary module.
Recommended Action None required.
Error Message %FWSM-1-105043: (Primary) Failover interface failed
Explanation Interface used to send failover messages to the secondary module failed. The active
module remains as active and the standby module remains as standby. There will not be any failure
detection or switchover activity until the failover interface becomes normal. (Primary) can also be
listed as (Secondary) for the secondary module.
Recommended Action Verify the VLAN and interface configuration of the failover interface is primary
and secondary.
Connection Messages
This section contains connection messages and the messages specific to the following message types:
•
FTP and URL
•
Routing Messages
•
ICMP
•
Routing Messages
•
RSH
•
RSH
•
SMTP
•
Routing Messages
•
ICMP
Error Message %FWSM-2-106002: protocol Connection denied by outbound list list_ID
src laddr dest faddr
Explanation This message indicates that the specified connection failed because of an outbound deny
command statement. The protocol variable can be ICMP, TCP, or UDP.
Recommended Action Use the show outbound command to check outbound lists.
Error Message %FWSM-4-106010: Deny inbound protocol src
interface_name:dest_address/dest_port dst
interface_name:source_address/source_port
Explanation This is a connection-related message. This message is logged if an inbound connection
is denied by your security policy.
Error Message Modify the security policy if traffic should be permitted. If the message occurs at regular
intervals, contact the remote peer administrator.
Error Message %FWSM-7-106011: Deny inbound (No xlate) chars
Explanation This message indicates that a packet was sent to the same interface that it arrived on. This
usually indicates that a security breach is occurring. When the module receives a packet, it tries to
establish a translation slot based on the security policy you set with the access-list commands, and
your routing policy set with the route command.
When the module polls both policies, the module allows the packet to flow from the higher priority network to a lower priority network, if it is consistent with the security policy. If a packet comes from a lower priority network and the security policy does not allow it, the module routes the packet back to the same interface.
To provide access from an interface with a higher security to a lower security, use the nat and global commands. For example, use the nat command to allow internal users access to external servers, to allow the internal users to access perimeter servers, and to allow perimeter users access to external servers.
To provide access from an interface with a lower security level to a higher security level, use the static and access-list commands. For example, use the static and access-list commands to let external users to access internal servers, external users to access perimeter servers, or perimeter servers to access internal servers.
Recommended Action Fix your configuration to reflect your security policy for handling these attack
events.
Error Message %FWSM-2-106016: Deny IP spoof from (IP_addr) to IP_addr on interface
int_name.
Explanation This message indicates that the module discards a packet with an invalid source address.
Invalid sources addresses are those addresses belong to the following:
–
Loopback network (127.0.0.0)
–
Broadcast (limited, net-directed, subnet-directed, and all-subnets-directed)
–
The destination host (land.c)
If a sysopt connection enforce subnet is enabled, the module discards those packets with an invalid source subnet preventing them from traversing the firewall and then logs this message.
To further spoof-packet detection, use the access-list command to configure the firewall to discard packets with source addresses belonging to the internal network.
Recommended Action Determine if an external user is trying to compromise the protected network.
Check for incorrectly configured clients.
Error Message %FWSM-2-106017: Deny IP due to Land Attack from IP_addr to IP_addr
Explanation This message indicates that the module received a packet with the IP source address
equal to the IP destination and the destination port equal to the source port. This indicates a spoofed
packet that is designed to attack systems. This attack is referred to as a land attack. If this message
persists, an attack may be in progress. The packet does not provide enough information to determine
where the attack originates.
Recommended Action None.
Error Message %FWSM-2-106020: Deny IP teardrop fragment (size = num, offset = num)
from IP_addr to IP_addr
Explanation The firewall discarded an IP packet with a teardrop signature containing either a small
offset or fragment overlapping. This is a hostile event to circumvent the module or an intrusion
detection system.
Recommended Action Contact the remote peer administrator or escalate this issue according to your
security policy.
Error Message %FWSM-1-106021: Deny protocol reverse path check from src_addr to
dest_addr on interface int_name
Explanation Someone is attempting to spoof an IP address on an inbound connection. Unicast Reverse
Path Forwarding, also known as reverse route lookup, detected a packet that does not have a source
address represented by a route and assumes it to be part of an attack on your module.
This message indicates that you have enabled Unicast Reverse Path Forwarding with the ip verify reverse-path command. This feature works on packets sent to an interface; if it is configured on the outside, then the module checks packets arriving from the outside. The following conditions apply:
–
The module looks up a route based on the src_addr. If an entry is not found and a route is not defined, then this syslog message appears and the connection is dropped.
–
If there is a route, the module checks which interface it corresponds to. If the packet arrived on another interface, then it is a spoof or there is an asymmetric routing environment. The firewall does not support asymmetric routing (where there is more than one path to a destination).
–
If configured on an internal interface, the module checks static route command statements or RIP and if the source address is not found, then an internal user is spoofing their address.
Recommended Action An attack is in progress. With this feature enabled, no user action is required.
The module repels the attack.
Error Message %FWSM-3-201002: Too many connections on static|xlate gaddr! econns
nconns
Explanation This message indicates that the maximum number of connections to the specified static
address has been exceeded. The econns variable is the maximum number of embryonic connections
and nconns is the maximum number of connections permitted for the static or translate (xlate).
Recommended Action Use the show static command to check the limit imposed on connections to a
static address. The limit is configurable.
Error Message %FWSM-2-201003: Embryonic limit exceeded neconns/elimit for
faddr/fport (gaddr) laddr/lport on interface int_name
Explanation This message indicates that the maximum number of embryonic connections from the
specified foreign address through the specified static global address to the specified local address has
been exceeded. When the limit on embryonic connections is reached, the module attempts to accept
them anyway, but puts a time limit on the connections. This allows some connections to succeed even
if the module is very busy. The neconns variable lists the number of embryonic connections received
and the limit variable lists the maximum number of embryonic connections specified in the static or
nat command. This message indicates a more serious overload than indicated in message 201002.
The overload could be caused by SYN attacks, or by a very heavy load of legitimate traffic.
Recommended Action Use the show static command to check the limit imposed on embryonic
connections to a static address.
Error Message %FWSM-3-407002: Embryonic limit neconns/elimit for through connections
Explanation This message provides information about connections through the firewall. This message
indicates that the number of connections from a specified foreign address over a specified global
address to the specified local address exceeds the maximum embryonic limit for that static. The
module attempts to accept the connection if it can allocate memory for that connection. It proxies on
behalf of local host and sends a SYN_ACK packet to the foreign host. The module retains pertinent
state information, drops the packet, and waits for the client's acknowledgment.
Recommended Action The traffic may be legitimate, or this message might indicate that a denial of
service (DoS) attack is in progress. Check the source address to determine where the packets are
coming from and whether it is a valid host.
Error Message %FWSM-3-202001: Out of address translation slots!
Explanation This message indicates that the module has no more address translation slots available.
Recommended Action Check the size of the global pool compared to the number of inside network
clients. A PAT address may be necessary. Alternatively, shorten the timeout interval of translates and
connections. This message may also be caused by insufficient memory; reduce the amount of
memory usage, or purchase additional memory.
Error Message %FWSM-3-202005: Non-embryonic in embryonic list faddr/fport
laddr/lport
Explanation This message indicates that a connection object (xlate) is in the wrong list.
Recommended Action Contact your customer support representative.
Error Message %FWSM-3-208005: (function:line_num) FWSM clear command return
return_code
Explanation The module received a non-zero value (an internal error) when attempting to clear the
configuration in Flash memory. The message includes the reporting subroutine's filename and line
number.
Recommended Action For performance reasons, the end host should be configured to not inject IP
fragments. This message probably occurred because of NFS. Set the read and write size to be the
interface MTU for NFS.
Error Message %FWSM-6-305001:Portmapped translation built for gaddr IP_addr/port
laddr IP_addr/port
Explanation This message indicates that a translate (xlate) is created for outbound traffic using a PAT
global address. This message applies to UDP, TCP, and ICMP packets.
Recommended Action None required.
Error Message %FWSM-6-305002:Translation built for gaddr IP_addr to laddr IP_addr
Explanation This message indicates that a translate (xlate) is created for outbound traffic using a
global address, or for either outbound or inbound traffic using a static address.
Recommended Action None required.
Error Message %FWSM-6-305003:Teardown translation for global IP_addr local IP_addr
Explanation This message indicates that the firewall clears a dynamically allocated translation after
the translate timeout expires.
Recommended Action None required.
Error Message %FWSM-6-305004:Teardown portmap translation for global IP_addr/port
local IP_addr/port
Explanation This message indicates that a port-mapped translation (PAT xlate) no longer in use has
been reclaimed.
Recommended Action None required.
Error Message %FWSM-3-305005: No translation group found for protocol.
Explanation This message indicates that a NAT and global command cannot be found for a protocol.
The protocol can be TCP, UDP, or ICMP.
Recommended Action This message can be either an internal error or an error in the configuration.
Error Message %FWSM-3-305006: Regular translation creation failed for protocol src
int_name:IP_addr/port dst int_name:IP_addr/port
Explanation A protocol (UDP, TCP, or ICMP) failed to create a translation through the module. This
message appears as a fix to caveat CSCdr0063, which requested that the module not allow packets
destined to network or broadcast addresses. The module provides this checking for addresses that are
explicitly identified with static command statements. With the change, for inbound traffic, the
module denies translations for a destined IP address identified as a network or broadcast address.
The module uses the global IP and mask from configured static command statements to differ regular IP addresses from network or broadcast IP addresses. If the global IP address is a valid network address with a matching network mask, then the module will not create a translate (xlate) for network or broadcast IP addresses with inbound packets.
Recommended Action This message can be either an internal error or an error in the configuration.
Error Message %FWSM-6-305007: Orphan IP IP_addr on interface interface_name
Explanation This message indicates that after the module attempts to translate an address that it
cannot find in any of its global pools it assumes that the address has been deleted and drops the
request.
Recommended Action None required.
Error Message %FWSM-6-609001: Built local-host int_name:ip_addr
Explanation A network state container is reserved for the host IP address connected to the interface
name. This is an informational message.
Recommended Action None required.
Error Message %FWSM-6-609002: Teardown local-host int_name:ip_addr duration hh:mm:ss
Explanation A network state container for the host IP address connected to interface name is removed.
This is an informational message.
Recommended Action None required.
Error Message %FWSM-3-305008: Free unallocated global IP address.
Explanation This message indicates an inconsistency condition when trying to free an unallocated
global IP address back to the address pool. This abnormal condition may occur if the module is
running a stateful failover setup and some of the internal states are momentarily out of sync between
the active and standby module. This condition is not catastrophic and the module will recover
automatically.
Recommended Action Report this condition to Cisco technical support if you continue to see this
message.
Error Message %FWSM-4-307004: Telnet session limit exceeded. Connection request from
IP_addr on interface int_name.
Explanation This message indicates that the maximum number of Telnet connections to the module
is exceeded. The module denies an attempt to connect to its Telnet port from the specified IP address
on the specified network.
Recommended Action None required.
Error Message %FWSM-4-308002: static gaddr1 laddr1 netmask mask1 overlapped with
gaddr2 laddr2
Explanation This message indicates that the IP addresses in one or more static command statements
overlap. gaddr is the global address, which is the address on the lower security interface and laddr is
the local address, which is the address on the higher security level interface.
Recommended Action Use the show static command to view the static command statements in your
configuration and fix the commands that overlap. The most common overlap occurs if you specify a
network address, such as 10.1.1.0, and in another static command statement specify a host within that
range such as 10.1.1.5.
Error Message %FWSM-4-500004: Invalid transport field for protocol=protocol, from
src_addr/src_port to dest_addr/dest_port
Explanation This message indicates there is an invalid transport number, in which the source or
destination port number for a protocol is zero. The protocol field is 6 for TCP and 17 for UDP.
Recommended Action If these messages persist, contact the peer's administrator.
FTP and URL
Error Message %FWSM-3-201005: FTP data connection failed for IP_addr
Explanation This message indicates that the module is unable to allocate a structure to track the data
connection for FTP because of insufficient memory.
Recommended Action Reduce the amount of memory usage, or purchase additional memory.
Error Message %FWSM-6-303002: src_addr Stored|Retrieved dest_addr: nat_addrs
Explanation This message indicates that the specified host successfully stores or retrieves data from
the specified FTP site. This message is used by the module manager to generate reports.
Recommended Action None required.
Error Message %FWSM-5-304001: user src_addr Accessed JAVA URL|URL dest_addr: url.
Explanation This message indicates that the specified host successfully accesses the specified URL.
This message is used by the module manager to generate reports.
Recommended Action None required.
Error Message %FWSM-5-304002: Access denied URL chars SRC IP_addr DEST IP_addr: chars
Explanation This message indicates that access from the source address failed.
Recommended Action None required.
Error Message %FWSM-3-304003: URL Server IP_addr timed out URL string
Explanation This message indicates that access from the URL server failed.
Recommended Action None required.
Error Message %FWSM-6-304004: URL Server IP_addr request failed URL chars
Explanation This message indicates that a Websense server request fails.
Recommended Action None required.
Error Message %FWSM-7-304005: URL Server IP_addr request pending URL chars
Explanation This message indicates that a Websense server request is pending.
Recommended Action None required.
Error Message %FWSM-3-304006: URL Server IP_addr not responding
Explanation The Websense server is unavailable for access, and the module attempts to either try to
access the same server if it is the only server installed or another server if there is more than one.
Recommended Action None required.
Error Message %FWSM-2-304007: URL Server IP_addr not responding, ENTERING ALLOW
mode.
Explanation This message indicates that when you use the allow option of the filter command the
Websense servers are not responding. The module allows all Web requests to continue without
filtering while the servers are not available.
Recommended Action None required.
Error Message %FWSM-2-304008: LEAVING ALLOW mode, URL Server is up.
Explanation This message indicates that when you use the allow option of the filter command that
the module received a response message from a Websense server that previously was not responding.
With this response message, the module exits the allow mode and enables the URL filtering feature
again.
Recommended Action None required.
Error Message %FWSM-4-406001: FTP port command low port: laddr, port to gaddr on
interface int_number
Explanation This message indicates the port is not responding.
Recommended Action None required.
Error Message %FWSM-4-406002: FTP port command different address: laddr to gaddr on
interface int_number
Explanation This message indicates the interface address is incorrect.
Recommended Action None required.
HTTP
Error Message %FWSM-6-605001: HTTP daemon interface int_name: Connection denied from
IP_addr
Explanation This message indicates that an HTTP connection to the module was denied.
Recommended Action None required.
Error Message %FWSM-6-605002: HTTP daemon connection limit exceeded
Explanation This message indicates that the number of HTTP connections to the module for Cisco
Secure PDM was exceeded.
Recommended Action None required.
Error Message %FWSM-6-605003: HTTP daemon: Login failed from IP_addr for user
"user_id"
Explanation This message indicates that Cisco Secure PDM login to the module failed.
Recommended Action None required.
ICMP
Error Message %FWSM-6-106010: Deny inbound icmp src outside: IP_addr dst inside:
IP_addr (type dec, code dec)
Explanation This message indicates that an inbound connection is denied by your security policy.
Recommended Action None required.
Explanation This message indicates that the module discards an inbound ICMP Echo Request packet
with a destination address that corresponds to a PAT global address. It is discarded because the
inbound packet cannot specify which PAT host should receive the packet.
Recommended Action None required.
Error Message %FWSM-3-106014: Deny inbound icmp src interface name: IP_addr dst
interface name: IP_addr (type dec, code dec)
Explanation This message indicates that the module denies any inbound ICMP packet access. By
default, all ICMP packets are denied access unless specifically permitted using the icmp permit
icmp command.
Recommended Action None required.
Error Message %FWSM-2-106018: ICMP packet type ICMP_type denied by outbound list
list_ID src laddr dest faddr
Explanation This message indicates that the outgoing ICMP packets with a specified ICMP type from
a local host to a foreign host is denied by the outbound list.
Recommended Action None required.
Error Message %FWSM-3-313001: Denied ICMP type=icmp_type, code=type_code from
IP_addr on interface int_name
Explanation When using the icmp command with an access list, if the first matched entry is a permit
entry, ICMP packet continues to be processed. If the first matched entry is a deny entry or an entry
is not matched, the module discards the ICMP packet and generates this syslog message. The icmp
command enables or disables pinging to an interface. With pinging disabled, the module cannot be
detected on the network. This feature is also referred to as configurable proxy pinging.
Recommended Action Contact the peer's administrator.
Error Message %FWSM-3-313003: Invalid destination, ICMP-packet-description, on
interface-name interface. Original IP payload, packet-description
Explanation The destination for the ICMP error message is different from the source of the IP packet
that generated the ICMP error message.
Recommended Action If the message occurs frequently, this could be an active network probe, an
attempt to use the ICMP error message as a covert channel, or an IP host that is not operating
properly. Contact the administrator of the host that originated the ICMP error message.
Error Message %FWSM-6-602101: PMTU-D packet packet_length bytes greater than
effective mtu mtu_value dest_addr=dest_ip, src_addr=source_ip, prot=protocol
Explanation This message occurs when the module sends an ICMP destination unreachable message
and when fragmentation is needed, but the don't-fragment bit is set.
Recommended Action Ensure that the data is sent correctly.
Routing Messages
This section contains the messages generated by the router configuration.
Error Message %FWSM-1-107001: RIP auth failed from IP_addr: version=vers, type=type,
mode=mode, sequence=seq on interface int_name
Explanation This is an alert log message. The module received a RIP reply message with bad
authentication. This could be due to an incorrectly configured router or the module or it could be a
unsuccessful attempt to attack the module's routing table.
Recommended Action This may be an attack and should be monitored. If you are not familiar with the
source IP address listed in this message, change your RIP authentication keys between trusted
entities. An attacker may be trying to deduce the existing keys.
Error Message %FWSM-1-107002: RIP pkt failed from IP_addr: version=vers on interface
int_name
Explanation This is an alert message. This message indicates a router bug, a packet with non-RFC
values inside, or malformed entries. This situation should not happen and may be an attempt to
exploit the firewall module's routing table.
Recommended Action This may be an attack and should be monitored. The packet has passed
authentication, if enabled, and bad data is in the packet. The situation should be monitored and the
keys should be changed if there are any doubts as to the originator of the packets.
Error Message %FWSM-6-110001: No route to dest_addr from src_addr
Explanation This message indicates a route lookup failure. A packet is looking for a destination IP
address, which is not in the routing table.
Recommended Action Check the routing table and make sure there is a route to the destination.
Error Message %FWSM-3-110002: No ARP for host IP_addr
Explanation This is a routing message. This message indicates that the module cannot resolve the
address of a host on one of its immediately connected networks. This usually occurs if the specified
host does not exist or is not reachable on the network. The module expects it to be on, for example,
if the host's address is incorrectly subnetted.
Recommended Action Check the ARP table and ensure the host is available. If necessary, add a static
ARP statement with the arp command or set the arp timeout value lower so that the ARP table will
refresh sooner.
Check that the host's IP address is appropriate to the network topology and your subnet scheme. Verify that the host is reachable by pinging it from another host. Use the show arp command to display the module's ARP table.The module minimally must be able to resolve the addresses of its SNMP server, routers, and syslog host.
Error Message %FWSM-6-312001: RIP hdr failed from IP_addr: cmd=cmd, version=vers
domain=name on interface int_name
Explanation The module received a RIP message with an operation code other than reply, the message
has a version number different than what is expected on this interface, and the routing domain entry
was non-zero.
Recommended Action This message is informational, but may also indicate that another RIP device is
not configured correctly to communicate with the module.
H.225
Error Message %FWSM-4-405101: Unable to Pre-allocate H225 Call Signalling Connection
for faddr faddr[/fport] to laddr laddr[/lport]
Explanation The module failed to allocate RAM system memory while starting a connection or has
no memory available.
Recommended Action If this message occurs periodically, it can be ignored. If it repeats frequently,
contact customer support. Also, check the size of the global pool compared to the number of inside
network clients. A PAT address may be necessary. Alternatively, shorten the timeout interval of
translates and connections. This message might be caused by insufficient memory; reduce the amount
of memory usage, or purchase additional memory.
Error Message %FWSM-4-405104: H225 message received from faddr/fport to laddr/lport
before SETUP
Explanation This message indicates that an H.225 message is received out of order. The H.225
message was received before the initial SETUP message, which is not allowed. The module has to
receive an initial SETUP message for that H.225 call-signaling channel before accepting any other
H.225 messages.
Recommended Action None required.
Error Message %FWSM-4-405103: H225 message from faddr/fport to laddr/lport contains
bad protocol discriminator
Explanation This message indicates that the message has incorrect protocol information.
Recommended Action None required.
H.245
Error Message %FWSM-7-302003: Built H245 connection for faddr faddr/fport laddr
laddr/lport
Recommended Action This message indicates that an H.245 connection is started from a foreign
address to a local address. This message only occurs if the module detects the use of an Intel Internet
phone. The foreign port (fport) only displays on connections from outside the module. The local port
value (lport) only appears on connections started on an internal port.
Recommended Action None required.
Error Message %FWSM-4-405102: Unable to Pre-allocate H245 Connection for faddr
faddr[/fport] to laddr laddr[/lport]
Explanation The module failed to allocate RAM system memory while starting a connection or has
no memory available.
Recommended Action If this message occurs periodically, it can be ignored. If it repeats frequently,
contact customer technical support. Also, check the size of the global pool compared to the number
of inside network clients. A PAT address may be necessary. Alternatively, shorten the timeout interval
of translates and connections. This message may also be caused by insufficient memory; reduce the
amount of memory usage, or purchase additional memory.
H.323
Error Message %FWSM-7-302004: Pre-allocate H323 UDP backconnection for faddr
faddr/fport to laddr laddr/lport
Explanation This message indicates that an H.323 UDP back-connection is preallocated to a foreign
address from a local address. This message is only generated if the module detects the use of an Intel
Internet phone. The foreign port (fport) only displays on connections from outside the module. The
local port value (lport) only appears on connections started on an internal interface.
Recommended Action None required.
Error Message %FWSM-4-405103: H323 RAS message AdmissionConfirm received from %I/%d
to %I/%d without an AdmissionRequest
Recommended Action None required.
IP Fragmentation
Error Message %FWSM-4-209003: Fragment database limit of bytes exceeded: src =
IP_addr, dest = IP_addr, proto = protocol, id = ID
Explanation Too many IP fragments are currently awaiting reassembly. By default, the maximum
number of fragments is 1 (refer to the fragment command in the Cisco PIX Firewall Command
Reference for more information). The firewall limits the number of IP fragments that can be
concurrently reassembled. This restriction prevents memory depletion at the firewall under abnormal
network conditions. In general, fragmented traffic should be a small percentage of the total traffic
mix. A noticeable exception is in a network environment with NFS over UDP; if this type of traffic
is relayed through the firewall, consider using NFS over TCP instead.
Refer to sysopt connection tcpmss bytes command in the Cisco PIX Firewall Command Reference for more information.
Refer to the sysopt connection tcpmss bytes command page in Chapter 5 of the Configuration Guide for the Cisco Secure Firewall Version 5.3 for more information.
Recommended Action If this message persists, a DoS (denial of service) attack might be in progress.
Contact the remote peer's administrator or upstream provider.
Error Message %FWSM-4-209004: Invalid IP fragment, size = bytes exceeds maximum size
= bytes: An IP fragment is malformed.
Explanation The total size of the reassembled IP packet exceeds the maximum possible size of 65,535
bytes.
Recommended Action A possible intrusion event may be in progress. If this message persists, contact
the remote peer's administrator or upstream provider.
Error Message %FWSM-4-209005: Discard IP fragment set with more than number elements:
src = Too many elements are in a fragment set.
Explanation The module disallows any IP packet that is fragmented into more than 24 fragments.
Recommended Action A possible intrusion event may be in progress. If the message persists, contact
the remote peer's administrator or upstream provider. You can change the number of fragments per
packet by using the fragment chain xxx int_name command.
SIP
Error Message %FWSM-7-607001: Pre-allocate SIP conn_type secondary channel for
outside-interface:address/port to inside-interface:address from sip_message
message
Explanation This message indicates that the fixup SIP preallocated a SIP connection after inspecting
a SIP message.
Recommended Action None required.
Skinny
Error Message %FWSM-7-608001: Pre-allocate Skinny conn_type secondary channel for
outside-interface:address to inside-interface:address/port from skinny_message
message
Explanation This message indicates that the fixup skinny preallocated a Skinny connection after
inspecting a Skinny message.
Recommended Action None required.
RSH
Error Message %FWSM-3-201005: FTP data connection failed for IP_addr
Explanation This message indicates that the module cannot allocate a structure to track the data
connection for FTP because of insufficient memory.
Recommended Action Reduce the amount of memory usage, or purchase additional memory.
RTSP
Error Message %FWSM-7-314001: Pre-allocate RTSP UDP back connection for faddr
faddr/fport to laddr laddr/lport
Explanation This message indicates that the module is unable to allocate and RTSP connection.
Recommended Action None required.
SMTP
Error Message %FWSM-2-108002: SMTP replaced chars: out src_addr in laddr data: chars
Explanation This is generated by the fixup protocol smtp command. This message indicates that the
module replaces an invalid character in an e-mail address with a space.
Recommended Action None required.
TCP
Error Message %FWSM-2-106001: Inbound TCP connection denied from IP_addr/port to
IP_addr/port flags TCP_flags on interface int_name
Explanation This message indicates that an attempt to connect to an inside address is denied by your
security policy. Possible TCP_flags values correspond to the flags in the TCP header that were
present when the connection was denied. For example, a TCP packet arrived for which no connection
state exists in the module, and it was dropped. The TCP_flags in this packet are FIN,ACK.
The TCP_flags are as follows:
•
ACK—The acknowledgment number was received.
•
FIN—Data was sent.
•
PSH—The receiver passed data to the application.
•
RST—The connection was reset.
•
SYN—Sequence numbers were synchronized to start a connection.
•
URG—The urgent pointer was declared valid.
Recommended Action None required.
Error Message %FWSM-6-106015: Deny TCP (no connection) from IP_addr/port to
IP_addr/port flags flags on interface int_name.
Explanation This message indicates that the module discards a TCP packet that has no associated
connection in the module module's connection table. The module looks for a SYN flag in the packet,
which indicates a request to establish a new connection. If the SYN flag is not set, and there is not
an existing connection, the module discards the packet.
Recommended Action The action is required unless the module receives a large volume of these invalid
TCP packets. If this is the case, trace the packets to the source and determine the reason these packets
were sent.
Error Message %FWSM-3-201009: TCP connection limit of limit-count for host
host-address on interface exceeded
Explanation This message indicates that the maximum number of connections to the specified static
address was exceeded. The limit-count variable is the maximum of connections permitted for the host
specified by the host-address variable.
Recommended Action Use the show static and show nat commands to check the limit imposed on
connections to an address. The limit is configurable.
Error Message %FWSM-6-302001: Built inbound|outbound TCP connection id for faddr
faddr/fport gaddr gaddr/gport laddr laddr/lport (username)
Explanation Explanation This is a connection-related message. This message reports that an
authenticated inbound or outbound TCP connection was started to foreign address faddr using the
global address gaddr from local address laddr. If the connection required authentication, the
username is reported in the last field of the message.
Recommended Action None required.
Error Message %FWSM-6-302002: Teardown TCP connection id for
interface:real-address/real-port to interface:real-address/real-port duration
hh:mm:ss bytes bytes [reason] [(user)]
Explanation A TCP connection between two hosts was deleted.
connection id is an unique identifier.
interface, real-address, real-port identify the actual sockets.
duration is the lifetime of the connection.
bytes bytes is the data transfer of the connection.
user is the AAA name of the user.
The reason variable presents the action that causes the connection to terminate. Set the reason variable to one of the TCP termination reasons listed in Table 0-3.
Table 0-3 TCP Termination Reasons
Reason
|
Description
|
Reset-I
|
Reset was from the inside.
|
Reset-O
|
Reset was from the outside.
|
TCP FINs
|
Normal close down sequence.
|
FIN Timeout
|
Force termination after 15 seconds awaiting last ACK
|
SYN Timeout
|
Force termination after two minutes awaiting three-way handshake completion.
|
Xlate Clear
|
Command-line removal.
|
Deny
|
Terminate by application inspection.
|
SYN Control
|
Back channel initiation from wrong side.
|
Uauth Deny
|
Deny by URL filter.
|
Unknown
|
Catch-all error.
|
Recommended Action None required.
Error Message %FWSM-6-302009: Rebuilt TCP connection id for faddr faddr/fport gaddr
gaddr/gport laddr laddr/lport
Explanation This message appears after a TCP connection is rebuilt after a failover. A sync packet is
not sent to the other module. The faddr IP address is the foreign host, the gaddr IP address is a global
address on the lower security level interface, and the laddr IP address is the local IP address behind
the module on the higher security level interface.
Recommended Action None required.
Error Message %FWSM-6-302010: conns in use, conns most used
Explanation This message appears after a TCP connection restarts. conns is the number of
connections.
Recommended Action None required.
Error Message %FWSM-7-302013: Built {inbound|outbound} TCP connection id for
interface:real-address/real-port (mapped-address/mapped-port) to
interface:real-address/real-port (mapped-address/mapped-port) [(user)]
Explanation A TCP connection slot between two hosts was created. If inbound is specified, then the
original control connection was initiated from the outside.
Recommended Action None required.
Error Message %FWSM-5-500003: Bad TCP hdr length (hdrlen=bytes, pktlen=bytes) from
src_addr/sport to dest_addr/dport, flags: tcp_flags, on interface int_name
Explanation This message indicates that a header length in TCP is incorrect. Some operating systems
do not handle TCP RSTs (resets) correctly when responding to a connection request to a disabled
socket. If a client tries to connect to an FTP server outside the module and FTP is not listening, then
the server sends an RST. Some operating systems send incorrect TCP header lengths, which causes
this problem. UDP uses ICMP port unreachable messages.
The TCP header length may indicate that it is larger than the packet length resulting in a negative number of bytes being transferred. A negative number is displayed by syslog as an unsigned number making it appear far larger than would be normal; for example, showing 4 GB transferred in 1 second.
Recommended Action None required. This message should occur infrequently.
UDP
Error Message %FWSM-2-106006: Deny inbound UDP from faddr/fport to laddr/lport on
interface int_name.
Explanation This message indicates that an inbound UDP packet is denied by your security policy.
Recommended Action None required.
Error Message %FWSM-2-106007: Deny inbound UDP from faddr/fport to laddr/lport due
to DNS flag.
Explanation This message indicates that a UDP packet containing a DNS query or response is denied.
The flag variable is either Response or Query.
Recommended Action If the inside port number is 53, the inside host probably is set up as a caching
name server. Add an access-list command statement to permit traffic on UDP port 53. If the outside
port number is 53, a DNS server was probably too slow to respond, and the query was answered by
another server.
Error Message %FWSM-7-302015: Built {inbound|outbound} UDP connection id for
interface:real-address/real-port (mapped-address/mapped-port) to
interface:real-address/real-port (mapped-address/mapped-port) [(user)]
Explanation A UDP connection slot between two hosts was deleted. If inbound is specified, then the
original control connection is initiated from the outside.
Recommended Action None required.
Error Message %FWSM-7-302016: Teardown UDP connection id for
interface:real-address/real-port to interface:real-address/real-port duration
hh:mm:ss bytes bytes [(user)]
Explanation A UDP connection slot between two hosts was deleted.
Recommended Action None required.
SSH
Error Message %FWSM-3-315001: Denied SSH session from IP_addr on interface int_name
Explanation This message indicates that the module denies an attempt to connect to the SSH port
from the specified IP address on the specified network interface.
Recommended Action From the console, enter the show ssh command to verify that the module is
configured to permit SSH access from the host or network.
Error Message %FWSM-6-315002: Permitted SSH session from IP_addr on interface
int_name for user "user_id"
Explanation This message indicates that an SSH session starts. The ip_addr is the address of the host
with the SSH client. The int_name is the interface through which the SSH session is started. The
user_ID is the username to which the client is accessing. Use the ssh show sessions command to view
the status of SSH sessions.
Explanation None required.
Error Message %FWSM-6-315003: SSH login session failed from IP_addr on (num attempts)
on interface int_name by user "user_id"
Explanation This message appears after an incorrect user ID or password were entered a certain
number of times for the same connection. Up to three attempts are allowed to log into a SSH console
session. The ip_addr is the address of the host with the SSH client. The int_name, is the interface
through which the SSH session is started. The user_ID is the username that the client is attempting
to access.
Recommended Action If this message appears infrequently, no action is required. If this message
appears frequently, it can indicate an attack. Inform the user to verify their username and password.
Error Message %FWSM-3-315004: Fail to establish SSH session because FWSM RSA host
key re