1

In my Cisco ASA firewall logs I'm seeing events being blocked with an external source IP and a external destination IP. This is happening in the same event log. An example would be:

TCP access denied by ACL from 235.97.144.162/6855 to outside:66.37.68.42/24

I'm curious as to why these events are happening.

closed as unclear what you're asking by Steffen Ullrich, Xander, NULLZ, Overmind, kalina Apr 28 at 4:09

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    What kind of firewall, and can you provide examples from the logs? – gowenfawr Apr 9 at 23:19
  • Cisco ASA Log: TCP access denied by ACL from 235.97.144.162/6855 to outside:66.37.68.42/24 Event Description: This message is displayed when the security appliance denies an attempt to connect to the interface service. For example, this message may occur when the firewall receives an SNMP request from an unauthorized SNMP management station. – errMSG Apr 10 at 13:08
1

The source address that you're seeing, 235.97.144.162, is not a normal IP address, it's an IPv4 Multicast Address. Any one of your internal systems can legitimately try to use it. It's used for trying to join into a stream of traffic that's being sent to multiple recipients - like a television signal that all TVs can tune in to. Your firewall isn't allowing it: that's fine; although you may be breaking some application, multicast isn't heavily used or reliably relied upon :).

  • gowenfawr, I scrambled those addresses for confidentiality but they still represent what I'm seeing in the logs if that makes any difference to your answer. I have several of these "Firewall Deny" logs being generated from "strange" external addresses. I understand why my firewall would be deflecting attacks but not why they would have destination ip's – errMSG Apr 10 at 13:32
  • If the "external" address is in the 224.0.0.0-239.255.255.255 range, then it's Multicast, and the first portion of the answer should still stand. Deleting the other bit :) – gowenfawr Apr 10 at 13:34
  • @gowenfawr Is it normal to a android device flood this type of connection (multicast)? My pc's firewall block a lot of this attempts, but I'm thinking about if others smartphones on the same network stays secure. – Mycroft Apr 10 at 14:43

Not the answer you're looking for? Browse other questions tagged or ask your own question.