ASA "Deny UDP reverse path check"

[North323]

i get a bunch of these type of messages in my syslog from various sources. is there a way i can 'drop' these connections versus deny and not log them to syslog? i got over 16k this weekend and a ticket for each one

any ideas?

 

[Supergrrover]

take off the reverse path check and just apply an acl to the inside interface.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[North323]

what is the difference? with reverse path enabled, these are being denied...the access list will deny them as well...will that give me a different syslog alarm?

 

[Supergrrover]

there are several differences on a systems level but for your purposes - you can change the level that the acl hit generates OR you can have the log subsystem ignore or change the level of the specific event. either would work in your case.

I actually like to see this event because it lets me know someone plugged in a foreign pc/system.

Brent
Systems Engineer / Consultant
CCNP, CCSP

 

[Supergrrover]

Sorry, missed example -

logging message xxxxxx level yyyyyy

Brent
Systems Engineer / Consultant
CCNP, CCSP