Cisco Reader Comment Card

Transcription

1 General Information Cisco Reader Comment Card 1 Years of networking experience: Years of experience with Cisco products: 2 I have these network types: LAN Backbone WAN Other: 3 I have these Cisco products: Switches Routers Other (specify models): 4 I perform these types of tasks: H/W installation and/or maintenance S/W configuration Network management Other: 5 I use these types of documentation: H/W installation H/W configuration S/W configuration Command reference Quick reference Release notes Online help Other: 6 I access this information through: % Cisco.com (CCO) % CD-ROM % Printed docs % Other: 7 I prefer this access method: 8 I use the following three product features the most: Document Information Document Title: Part Number: S/W Release (if applicable): Version 6.3 On a scale of 1 5 (5 being the best), please let us know how we rate in the following areas: The document is written at my technical level of understanding. The document is complete. The information is well organized. The information is accurate. The information I wanted was easy to find. The information I found was useful to my job. Please comment on our lowest scores: Mailing Information Company Name Contact Name Mailing Address Job Title Date City State/Province ZIP/Postal Code Country Phone ( ) Extension Fax ( ) Can we contact you further concerning our documentation? Yes No You can also send us your comments by to bug-doc@cisco.com, or by fax to

2 BUSINESS REPLY MAIL FIRST-CLASS MAIL PERMIT NO SAN JOSE CA POSTAGE WILL BE PAID BY ADDRESSEE ATTN DOCUMENT RESOURCE CONNECTION CISCO SYSTEMS INC 170 WEST TASMAN DRIVE SAN JOSE CA NO POSTAGE NECESSARY IF MAILED IN THE UNITED STATES

3 Version 6.3 Corporate Headquarters Cisco Systems, Inc. 170 West Tasman Drive San Jose, CA USA Tel: NETS (6387) Fax: Customer Order Number: DOC = Text Part Number:

4 THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS. THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY. The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB s public domain version of the UNIX operating system. All rights reserved. Copyright 1981, Regents of the University of California. NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED AS IS WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE. IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. g y g y g Scorecard, Networking Academy, and ScriptShare are trademarks of Cisco Systems, Inc.; Changing the Way We Work, Live, Play, and Learn, The Fastest Way to Increase Your Internet Quotient, and iquick Study are service marks of Cisco Systems, Inc.; and Aironet, ASIST, BPX, Catalyst, CCDA, CCDP, CCIE, CCNA, CCNP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, the Cisco IOS logo, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Empowering the Internet Generation, Enterprise/Solver, EtherChannel, EtherSwitch, Fast Step, GigaStack, Internet Quotient, IOS, IP/TV, iq Expertise, the iq logo, LightStream, MGX, MICA, the Networkers logo, Network Registrar, Packet, PIX, Post-Routing, Pre-Routing, RateMUX, Registrar, SlideCast, SMARTnet, StrataView Plus, Stratm, SwitchProbe, TeleRouter, TransPath, and VCO are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and certain other countries. All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0303R) Copyright 2003 Cisco Systems, Inc. All rights reserved.

5 CONTENTS About This Guide xiii Document Objectives xiii Audience xiii Document Organization xiv Document Conventions xiv Related Documentation xiv Obtaining Documentation xiv Cisco.com xv Documentation CD-ROM xv Ordering Documentation xv Documentation Feedback xvi Obtaining Technical Assistance xvi Cisco.com xvi Technical Assistance Center xvi Obtaining Additional Publications and Information xviii CHAPTER 1 Introduction 1-1 New and Deleted Messages 1-1 EMBLEM Format Option in Version New and Deleted Messages in Version New and Changed Messages in Version Logging Command Overview 1-6 Enabling Logging 1-9 Testing the Logging Output 1-9 Setting the Syslog Output Location 1-10 Sending Syslog Messages to the Buffer 1-10 Sending Syslog Messages to a Telnet Console Session 1-11 Sending Syslog Messages to a Syslog Server 1-12 Sending Syslog Messages to an SNMP Management Station 1-13 Disabling and Enabling Specific Syslog Messages 1-14 Disabling Specific Syslog Messages 1-14 Viewing a List of Disabled Syslog Messages 1-14 Reenabling Specific Disabled Syslog Messages 1-14 Reenabling All Disabled Syslog Messages 1-14 iii

6 Contents Understanding Log Messages 1-15 Log Message Format 1-15 Severity Levels 1-16 Variables 1-16 Other Remote Management and Monitoring Tools 1-19 Cisco PIX Device Manager 1-19 Cisco Secure Policy Manager 1-19 SNMP Traps 1-20 Telnet 1-20 CHAPTER Messages to , , , iv

7 Contents v

8 Contents Messages to vi

9 Contents Messages to vii

10 Contents Messages to nn viii

11 Contents d ix

12 Contents Messages to Messages to Messages to Messages to x

13 Contents xi

14 Contents Messages to , APPENDIX A Messages Listed by Severity Level A- 1 Alert Messages, User-Defined Severity A- 1 Alert Messages, Severity 1 A- 1 Critical Messages, Severity 2 A- 3 s, Severity 3 A- 4 Warning Messages, Severity 4 A- 6 Notification Messages, Severity 5 A- 8 Informational Messages, Severity 6 A- 9 Debugging Messages, Severity 7 A- 13 I NDEX xii

15 About This Guide This preface describes: Document Objectives, page xiii Audience, page xiii Document Organization, page xiv Document Conventions, page xiv Related Documentation, page xiv Obtaining Documentation, page xiv Obtaining Technical Assistance, page xvi Document Objectives This guide describes the system log (syslog) messages generated by the Cisco PIX Firewall software Version 6.3. Messages that display on the console from non-syslog errors are not listed. See the New and Deleted Messages section on page 1-1 for a list of new and deleted messages in recent versions of the software. Audience This guide is intended for network managers who perform any of the following tasks: Managing network security Configuring, administering, and troubleshooting firewalls This guide assumes that you are familiar with the commands and configuration options described in the Cisco PIX Firewall Command Reference. In addition, you should be familiar with the network within which the PIX Firewall operates. xiii

16 Document Organization About This Guide Document Organization This guide is organized as follows: Chapter 1, Introduction describes the system log message function, and explains the format of log messages. Chapter 2, lists the system log messages, indicates the probable cause of each message, and provides instructions for resolving the condition that caused the log message. Appendix A, Messages Listed by Severity Level lists message numbers and text by each severity level. Document Conventions This guide uses the following conventions: Filenames, directory names, and arguments for which you supply values are in italics. The symbol ^ represents the key labeled Ctrl (control). To enter a control key; for example, ^z, hold down the Ctrl key while you press the z key. Command names, keys, buttons, and keywords in text are shown in boldface. The PIX Firewall commands are described in detail in the Cisco PIX Firewall Command Reference. Variables in command syntax descriptions are shown in italics. Command options in square brackets [ ] can be optionally entered, and parameters separated by a vertical bar ( ) require you to enter one parameter, but not the other(s). Examples depict screen displays and the command line in screen font. Information you need to enter in examples is shown in boldface screen font. Variables that require you to supply a value are shown in italic screen font. Selecting a menu item (or screen) is indicated by the following convention: Click screen1>screen2>screen3. Note Means reader take note. Notes contain helpful suggestions or references to material not covered in the manual. Related Documentation Use this document with the PIX Firewall documentation set, which is available online at the following website: Obtaining Documentation Cisco provides several ways to obtain documentation, technical assistance, and other technical resources. These sections explain how to obtain technical information from Cisco Systems. xiv

17 About This Guide Obtaining Documentation Cisco.com You can access the most current Cisco documentation on the World Wide Web at this URL: You can access the Cisco website at this URL: International Cisco web sites can be accessed from this URL: Documentation CD-ROM Cisco documentation and additional literature are available in a Cisco Documentation CD-ROM package, which may have shipped with your product. The Documentation CD-ROM is updated monthly and may be more current than printed documentation. The CD-ROM package is available as a single unit or through an annual subscription. Registered Cisco.com users can order the Documentation CD-ROM (product number DOC-CONDOCCD=) through the online Subscription Store: Ordering Documentation You can find instructions for ordering documentation at this URL: You can order Cisco documentation in these ways: Registered Cisco.com users (Cisco direct customers) can order Cisco product documentation from the Networking Products MarketPlace: Registered Cisco.com users can order the Documentation CD-ROM (Customer Order Number DOC-CONDOCCD=) through the online Subscription Store: Nonregistered Cisco.com users can order documentation through a local account representative by calling Cisco Systems Corporate Headquarters (California, U.S.A.) at or, elsewhere in North America, by calling NETS (6387). xv

18 Obtaining Technical Assistance About This Guide Documentation Feedback You can submit comments electronically on Cisco.com. On the Cisco Documentation home page, click Feedback at the top of the page. You can your comments to You can submit your comments by mail by using the response card behind the front cover of your document or by writing to the following address: Cisco Systems Attn: Customer Document Ordering 170 West Tasman Drive San Jose, CA We appreciate your comments. Obtaining Technical Assistance Cisco provides Cisco.com, which includes the Cisco Technical Assistance Center (TAC) Website, as a starting point for all technical assistance. Customers and partners can obtain online documentation, troubleshooting tips, and sample configurations from the Cisco TAC website. Cisco.com registered users have complete access to the technical support resources on the Cisco TAC website, including TAC tools and utilities. Cisco.com Cisco.com offers a suite of interactive, networked services that let you access Cisco information, networking solutions, services, programs, and resources at any time, from anywhere in the world. Cisco.com provides a broad range of features and services to help you with these tasks: Streamline business processes and improve productivity Resolve technical issues with online support Download and test software packages Order Cisco learning materials and merchandise Register for online skill assessment, training, and certification programs To obtain customized information and service, you can self-register on Cisco.com at this URL: Technical Assistance Center The Cisco TAC is available to all customers who need technical assistance with a Cisco product, technology, or solution. Two levels of support are available: the Cisco TAC website and the Cisco TAC Escalation Center. The avenue of support that you choose depends on the priority of the problem and the conditions stated in service contracts, when applicable. xvi

19 About This Guide Obtaining Technical Assistance Cisco TAC Website Cisco TAC Escalation Center We categorize Cisco TAC inquiries according to urgency: Priority level 4 (P4) You need information or assistance concerning Cisco product capabilities, product installation, or basic product configuration. Priority level 3 (P3) Your network performance is degraded. Network functionality is noticeably impaired, but most business operations continue. Priority level 2 (P2) Your production network is severely degraded, affecting significant aspects of business operations. No workaround is available. Priority level 1 (P1) Your production network is down, and a critical impact to business operations will occur if service is not restored quickly. No workaround is available. You can use the Cisco TAC website to resolve P3 and P4 issues yourself, saving both cost and time. The site provides around-the-clock access to online tools, knowledge bases, and software. To access the Cisco TAC website, go to this URL: All customers, partners, and resellers who have a valid Cisco service contract have complete access to the technical support resources on the Cisco TAC website. Some services on the Cisco TAC website require a Cisco.com login ID and password. If you have a valid service contract but do not have a login ID or password, go to this URL to register: If you are a Cisco.com registered user, and you cannot resolve your technical issues by using the Cisco TAC website, you can open a case online at this URL: If you have Internet access, we recommend that you open P3 and P4 cases through the Cisco TAC website so that you can describe the situation in your own words and attach any necessary files. The Cisco TAC Escalation Center addresses priority level 1 or priority level 2 issues. These classifications are assigned when severe network degradation significantly impacts business operations. When you contact the TAC Escalation Center with a P1 or P2 problem, a Cisco TAC engineer automatically opens a case. To obtain a directory of toll-free Cisco TAC telephone numbers for your country, go to this URL: Before calling, please check with your network operations center to determine the level of Cisco support services to which your company is entitled: for example, SMARTnet, SMARTnet Onsite, or Network Supported Accounts (NSA). When you call the center, please have available your service agreement number and your product serial number. xvii

20 Obtaining Additional Publications and Information About This Guide Obtaining Additional Publications and Information Information about Cisco products, technologies, and network solutions is available from various online and printed sources. The Cisco Product Catalog describes the networking products offered by Cisco Systems as well as ordering and customer support services. Access the Cisco Product Catalog at this URL: Cisco Press publishes a wide range of networking publications. Cisco suggests these titles for new and experienced users: Internetworking Terms and Acronyms Dictionary, Internetworking Technology Handbook, Internetworking Troubleshooting Guide, and the Internetworking Design Guide. For current Cisco Press titles and other information, go to Cisco Press online at this URL: Packet magazine is the Cisco monthly periodical that provides industry professionals with the latest information about the field of networking. You can access Packet magazine at this URL: iq Magazine is the Cisco monthly periodical that provides business leaders and decision makers with the latest information about the networking industry. You can access iq Magazine at this URL: Internet Protocol Journal is a quarterly journal published by Cisco Systems for engineering professionals involved in the design, development, and operation of public and private internets and intranets. You can access the Internet Protocol Journal at this URL: Training Cisco offers world-class networking training, with current offerings in network training listed at this URL: xviii

21 CHAPTER 1 Introduction This chapter lists new and deleted messages in recent versions of the PIX Firewall software. It also describes how to view and manage syslog messages, how to understand the messages, and which other remote management and monitoring tools are available. Note Not all system log messages represent error conditions. Some messages simply report normal events. This chapter includes the following sections: New and Deleted Messages, page 1-1 Logging Command Overview, page 1-6 Enabling Logging, page 1-9 Setting the Syslog Output Location, page 1-10 Disabling and Enabling Specific Syslog Messages, page 1-14 Understanding Log Messages, page 1-15 Other Remote Management and Monitoring Tools, page 1-19 New and Deleted Messages This section lists new and deleted messages for each software release: EMBLEM Format Option in Version 6.3.1, page 1-1 New and Deleted Messages in Version 6.3.1, page 1-2 New and Changed Messages in Version 6.3.2, page 1-5 EMBLEM Format Option in Version This feature enables you to log messages to a syslog server in Cisco EMBLEM format. EMBLEM syslog format is designed to be consistent with the Cisco IOS format and is more compatible with CiscoWorks management applications. Example: [no] logging host [in_if_name] ip_address [protocol/port] [format emblem] 1-1

22 New and Deleted Messages Chapter 1 Introduction UDP only EMBLEM format logging is available for UDP syslog messages only (because the RME syslog analyzer only supports UDP syslog messages). If you use the option with TCP/port# an error is generated. If EMBLEM format logging is enabled for a particular syslog host, then EMBLEM format messages are sent to that host. logging host The logging host ip_address format emblem command enables EMBLEM format logging on a per-syslog-server basis. timestamp The EMBLEM format is available for both messages with and without timestamp. If the logging timestamp option is also enabled, then EMBLEM format messages with a time stamp are sent. device-id The logging device-id command displays a unique device ID in non-emblem format syslog messages that are sent to the syslog server. This command is available in PIX Firewall software Version and higher. If enabled, the PIX Firewall displays the device ID in all non-emblem-formatted syslog messages. However, it does not affect the syslog message text that is in EMBLEM format. New and Deleted Messages in Version New Messages in Version The following sections list messages that were added or deleted in Version 6.3.1: New Messages in Version 6.3.1, page 1-2 Deleted Messages in Version 6.3.1, page 1-5 The following messages were added in Version %PIX-n : access-list acl_id {permitted denied est-allowed} protocol interface_name/source_address(source_port) -> interface_name/dest_address(dest_port) hit-cnt number ({first hit number-second interval}) %PIX The number of ACL log deny-flows has reached limit (number). %PIX : Uauth null proxy error %PIX : exceeded HTTPS proxy process limit %PIX :Bad route_compress() call, sdb= number %PIX : H.323 library_name ASN Library failed to initialize, error code number %PIX : No memory available for limit_slow %PIX : Bad path index of number for IP_address, number max %PIX : IP routing table creation failure - reason %PIX : IP routing table limit warning %PIX : IP routing table limit exceeded - reason, IP_address netmask %PIX : Internal error: reason %PIX : Flagged as being an ABR without a backbone area %PIX : Reached unknown state in neighbor state machine %PIX : area string lsid IP_address mask netmask adv IP_address type number 1-2

23 Chapter 1 Introduction New and Deleted Messages %PIX : lsid IP_address adv IP_address type number gateway gateway_address metric number network IP_address mask netmask protocol hex attr hex net-metric number %PIX : if interface_name if_state number %PIX : OSPF is enabled on interface_name during idb initialization %PIX : OSPF process number is changing router-id. Reconfigure virtual link neighbors with our new router-id %PIX : The subject name of the peer cert is not allowed for connection %PIX : Received ARP {request response} collision from IP_address/mac_address on interface interface_name, page 2-61 %PIX : Received mac mismatch collision from IP_address/mac_address for authenticated host, page 2-62 %PIX : IP route counter negative - reason, IP_address Attempt: number %PIX : Database scanner: external LSA IP_address netmask is lost, reinstalls %PIX : db_free: external LSA IP_address netmask %PIX : Received invalid packet: reason from IP_address, interface_name %PIX : Received reason from unknown neighbor IP_address %PIX : Invalid length number in OSPF packet from IP_address (ID IP_address), interface_name %PIX : Invalid lsa: reason Type number, LSID IP_address from IP_address, IP_address, interface_name %PIX : Found LSA with the same host bit set but using different mask LSA ID IP_address netmask New: Destination IP_address netmask %PIX : Found generating default LSA with non-zero mask LSA type : number Mask : IP_address metric : number area : string %PIX : OSPF process number cannot start. There must be at least one up IP interface, for OSPF to use as router ID %PIX : Virtual link information found in non-backbone area: string %PIX : OSPF detected duplicate router-id IP_address from IP_address on interface interface_name %PIX : Detected router with duplicate router ID IP_address in area string %PIX : Detected router with duplicate router ID IP_address in Type-4 LSA advertised by IP_address %PIX : UDP DNS packet dropped due to domainname length check of 255 bytes: actual length:<n> bytes, page 2-68 %PIX : Process number, Nbr IP_address on interface_name from string to string, reason %PIX : Serial console idle timeout exceeded %PIX : Login denied from {source_address/source_port serial} to {interface_name:dest_address/service console} for user "user" %PIX : Login permitted from {source_address/source_port serial} to {interface_name:dest_address/service console} for user "user" %PIX : VPNClient: Backup Server List: reason %PIX : VPNClient: Backup Server List Error: reason 1-3

24 New and Deleted Messages Chapter 1 Introduction %PIX : VPNClient: Load Balancing Cluster with Virtual IP: IP_address has redirected the PIX to server IP_address %PIX : VPNClient: Disconnecting from Load Balancing Cluster member IP_address %PIX : VPNClient: Secure Unit Authentication Enabled %PIX : VPNClient: Secure Unit Authentication Disabled %PIX : VPNClient: User Authentication Enabled: Auth Server IP: IP_address Auth Server Port: port Idle Timeout: time %PIX : VPNClient: User Authentication Disabled %PIX : VPNClient: Device Pass Thru Enabled %PIX : VPNClient: Device Pass Thru Disabled %PIX : VPNClient: Extended XAUTH conversation initiated when SUA disabled %PIX : VPNClient: Duplicate split nw entry %PIX : Checksum Failure in database in area string Link State Id IP_address Old Checksum number New Checksum number %PIX : interface interface_name has zero bandwidth %PIX : IP_address netmask changed from area string to area string %PIX : Pre-allocate CTIQBE {RTP RTCP} secondary channel for interface_name:outside_address[/outside_port] to interface_name:inside_address[/inside_port] from CTIQBE_message_name message %PIX : Unsupported CTIQBE version: hex: from interface_name:ip_address/port to interface_name:ip_address/port %PIX : H.225 message received from interface_name:ip_address/port to interface_name:ip_address/port is using an unsupported version number %PIX : Received H.225 Release Complete with newconnectionneeded for interface_name:ip_address to interface_name:ip_address/port %PIX : TCP access requested from source_address/source_port to interface_name:dest_address/service %PIX : {TCP UDP} access permitted from source_address/source_port to interface_name:dest_address/service %PIX : {TCP UDP} access denied by ACL from source_address/source_port to interface_name:dest_address/service %PIX : TCP connection limit exceeded from source_address/source_port to interface_name:dest_address/service %PIX : {TCP UDP} request discarded from source_address/source_port to interface_name:dest_address/service %PIX : protocol request discarded from source_address to interface_name:dest_address 1-4