Repeated UDP access denied errors for netbios broadcast

[barrybyrne]

Hi,

I'm getting repeated errors regarding broadcast traffic on all interfaces on our PIX 515 running version 7.0 software. Examples below. This would appear to be NetBIOS broadcast traffic, but I don't understand why it should try to pass the interface, as the interface (wifi) is specified as 10.10.8.1/24. I've tried a myriad of different access-lists but can't stop the errors being logged.

Any help or insight would be appreciated.

Thanks,

Barry

Apr 26 16:55:53 pix1 Apr 26 2005 16:55:53 : %PIX-3-710003: UDP access denied by ACL from 10.10.8.213/138 to wifi:10.10.8.255/138
Apr 26 16:56:00 pix1 Apr 26 2005 16:56:00 : %PIX-3-710003: UDP access denied by ACL from 10.10.8.204/137 to wifi:10.10.8.255/137

 

[LloydSev]

What logging level are you running?? Informational?

This is my setup..

logging on
logging timestamp
logging trap notifications
logging host inside cssnt04
no logging message 400011

Cisco PIX Firewall Version 6.3(4)
Cisco PIX Device Manager Version 3.0(2)

Compiled on Fri 02-Jul-04 00:07 by morlee

vpn up 13 days 19 hours

Trap logging: level notifications, 528118 messages logged

Computer/Network Technician
CCNA

 

[barrybyrne]

Logging errors:

logging enable
logging timestamp
logging trap errors
logging host lan loghost

 

[LloydSev]

One thing to note.. broadcast traffic doesn't just goto one IP address.. your PIX is giving you an error because it doesn't forward broadcasts.. it can't do anything with it.

That would be normal behavior.

Computer/Network Technician
CCNA

 

[barrybyrne]

Thanks for your input.

I understand it doesn't forward broadcasts - I wouldn't expect it to, but I don't understand why it logs it as an error.

Cheers,

Barry

 

[LloydSev]

that's a good question, that maybe cisco could answer.. as it obviously was a change in procedure from 6.3(4) to 7.0

Computer/Network Technician
CCNA

 

[dopehead]

not anything changed there, local broadcasts have always been logged as an acl violation beacause it is not allowed at all. That msg is not an error, just information.


Network Systems Engineer
CCNA/CQS/CCSP/Infosec

 

[slyride]

If you do not care about those messages you can disable that error using the command
no logging message 710003

 

[LloydSev]

my bad, I don't remember seeing those messages in my syslog server.... 's why i figured it was a change.. and i run mine as pointed above, at notification level.

Computer/Network Technician
CCNA

 

[barrybyrne]

Thanks for the input.

I've disabled the logging of that error number for the present. Think it's a bit strange as it's logged at severity level 3, and other errors with this number might be relevant. Will raise it with Cisco and see what they say.

Cheers,

Barry