This is explained? (Help)

6 Sep 05-2014 21:28:46   192.168.1.2 37071 199.195.xxx.xxx 37071 Dynamic translation TCP disassembly of any:192.168.1.2/37071 to Outside:199.195.xxx.xxx/37071 duration 0:00:31

Hello

I hope I can get this explained to me in simple terms so I understand what is happening. I thought that I had stated in my config that allowed all traffic of my internal networks to external networks, but my Active log is filled with packets are blocked and blocked. I'm just curious to know what is happening here. It is with UDP and TCP.

Thank you!

I have tons of them:

6 Sep 05-2014 21:36:59   192.168.1.2 62608 199.195.xxx.xxx 62608 Built a dynamic UDP conversion of any:192.168.1.2/62608 to Outside:199.195.xxx.xxx/62608
6 Sep 05-2014 21:36:59   199.195.xxx.x 53 192.168.1.2 62608 UDP connection disassembly 6952281 for Outside:199.195.xxx.x/53 for Inside:192.168.1.2/62608 duration 0: 00:00 152 bytes
6 Sep 05-2014 21:36:58   10.10.1.2 63481 199.195.xxx.xxx 63481 Dynamic translation UDP disassembly of any:10.10.1.2/63481 to Outside:199.195.xxx.xxx/63481 duration 0:00:31

The ASA config:

ASA5510 # sh run
: Saved
:
ASA Version 9.1 (4)
!
hostname ASA5510
domain maladomini.int
activate liqhNWIOSfzvir2g encrypted password
volatile xlate deny tcp any4 any4
volatile xlate deny tcp any4 any6
volatile xlate deny tcp any6 any4
volatile xlate deny tcp any6 any6
volatile xlate deny udp any4 any4 eq field
volatile xlate deny udp any4 any6 eq field
volatile xlate deny udp any6 any4 eq field
volatile xlate deny udp any6 any6 eq field
liqhNWIchangedvir2g encrypted passwd
names of
DNS-guard
!
interface Ethernet0/0
LAN Interface Description
nameif inside
security-level 100
IP 10.10.1.1 255.255.255.252
!
interface Ethernet0/1
Description of the WAN Interface
nameif outside
security-level 0
IP address 199.195.xxx.x 255.255.255.240
!
interface Ethernet0/2
DMZ description
nameif DMZ
security-level 100
IP 10.10.0.1 255.255.255.252
!
interface Ethernet0/3
VOIP description
nameif VOIP
security-level 100
IP 10.10.2.1 255.255.255.252
!
interface Management0/0
management only
Shutdown
nameif management
security-level 0
no ip address
!
boot system Disk0: / asa914 - k8.bin
passive FTP mode
DNS domain-lookup outside
DNS server-group DefaultDNS
Server name 199.195.xxx.x
Server name 205.171.2.65
Server name 205.171.3.65
domain maladomini.int
permit same-security-traffic inter-interface
the ROUTER-2811 object network
10.10.1.2 home
the ROUTER-2821 object network
Home 10.10.0.2
network of the WEBCAM-01 object
host 192.168.1.5
the DNS SERVER object network
host 192.168.1.2
the ROUTER-3745 object network
host 10.10.2.2
network of the RDP - DC1 object
host 192.168.1.2
PAT-SOURCE network object-group
object-network 10.10.1.0 255.255.255.252
object-network 10.10.0.0 255.255.255.252
network-object 10.10.2.0 255.255.255.252
object-network 192.168.0.0 255.255.255.0
object-network 172.16.10.0 255.255.255.0
object-network 172.16.20.0 255.255.255.0
object-network 128.162.1.0 255.255.255.0
object-network 128.162.10.0 255.255.255.0
object-network 128.162.20.0 255.255.255.0
the DM_INLINE_NETWORK_2 object-group network
network-host 98.22.xxx.xxx object
the Outside_access_in object-group network
object-group Protocol DM_INLINE_PROTOCOL_1
object-protocol gre
allow access-list of standard USERS 10.10.1.0 255.255.255.0
Outside_access_in list extended access permit tcp host object eq ROUTER-2811 98.22.xxx.xx ssh
Outside_access_in list extended access permit tcp host object eq ROUTER-2821 98.22.xxx.xx ssh
Outside_access_in list extended access permit tcp host 98.22.xxx.xx interface outside eq https
Outside_access_in list extended access permit tcp host object 98.22.xxx.xx WEBCAM-01 eq www
access-list extended Outside_access_in permit tcp host 98.22.xxx.xx eq 3389 RDP - DC1 object
IP 128.162.1.0 allow Access-list access-dmz-vlan1 extended 255.255.255.0 any
Note access-list access dmz allow all traffic in DC1
permit access-list extended access dmz ip 128.162.1.0 255.255.255.0 192.168.1.2 host
Note dmz access list only allow DNS traffic to the DNS server
permit access-list extended access dmz udp 128.162.1.0 255.255.255.0 192.168.1.2 host eq field
Note to dmz-access access-list ICMP allow devices in DC
permit access-list extended access dmz icmp 128.162.1.0 255.255.255.0 192.168.1.0 255.255.255.0
pager lines 24
Enable logging
asdm of logging of information
Within 1500 MTU
Outside 1500 MTU
management of MTU 1500
MTU 1500 DMZ
MTU 1500 VOIP
ICMP unreachable rate-limit 1 burst-size 1
ICMP deny everything outside
ASDM image disk0: / asdm - 715.bin
don't allow no asdm history
ARP timeout 14400
no permit-nonconnected arp
!
the ROUTER-2811 object network
NAT (inside, outside) interface static tcp ssh 222 service
the ROUTER-2821 object network
NAT (DMZ, outside) static interface tcp ssh 2222 service
network of the WEBCAM-01 object
NAT (inside, outside) interface static tcp 8080 www service
the ROUTER-3745 object network
NAT (VOIP, outdoor) static interface service tcp ssh 2223
network of the RDP - DC1 object
NAT (inside, outside) interface static service tcp 3389 3389
!
NAT interface (it is, outside) the after-service automatic PAT-SOURCE dynamic source
Access-group Outside_access_in in interface outside
!
router RIP
10.0.0.0 network
version 2
No Auto-resume
!
Route outside 0.0.0.0 0.0.0.0 199.195.xxx.xxx 1
Route inside 128.162.1.0 255.255.255.0 10.10.0.2 1
Route inside 128.162.10.0 255.255.255.0 10.10.0.2 1
Route inside 128.162.20.0 255.255.255.0 10.10.0.2 1
Route inside 172.16.10.0 255.255.255.0 10.10.1.2 1
Route inside 172.16.20.0 255.255.255.0 10.10.1.2 1
Route inside 192.168.1.0 255.255.255.0 10.10.1.2 1
Timeout xlate 03:00
Pat-xlate timeout 0:00:30
Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
Floating conn timeout 0:00:00
dynamic-access-policy-registration DfltAccessPolicy
identity of the user by default-domain LOCAL
the ssh LOCAL console AAA authentication
Enable http server
http 0.0.0.0 0.0.0.0 inside
http 98.22.xxx.xxx 255.255.255.255 outside
No snmp server location
No snmp Server contact
Server enable SNMP traps snmp authentication linkup, linkdown cold start
Crypto ipsec pmtu aging infinite - the security association
trustpool crypto ca policy
Telnet timeout 5
SSH 0.0.0.0 0.0.0.0 inside
SSH 98.22.xxx.xxx 255.255.255.255 outside
SSH timeout 60
SSH version 2
SSH group dh-Group1-sha1 key exchange
Console timeout 0
a basic threat threat detection
Statistics-list of access threat detection
no statistical threat detection tcp-interception
NTP server 24.56.178.140 prefer external source
username redacted encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
type of policy-card inspect dns migrated_dns_map_1
parameters
maximum message length automatic of customer
message-length maximum 512
Policy-map global_policy
class inspection_default
inspect the migrated_dns_map_1 dns
inspect the ftp
inspect h323 h225
inspect the h323 ras
inspect the rsh
inspect the rtsp
inspect esmtp
inspect sqlnet
inspect the skinny
inspect sunrpc
inspect xdmcp
inspect the sip
inspect the netbios
inspect the tftp
Review the ip options
inspect the icmp
inspect the icmp error
inspect the pptp
!
global service-policy global_policy
context of prompt hostname
no remote anonymous reporting call
call-home
Profile of CiscoTAC-1
no active account
http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address
email address of destination [email protected] / * /
destination-mode http transport
Subscribe to alert-group diagnosis
Subscribe to alert-group environment
Subscribe to alert-group monthly periodic inventory
monthly periodicals to subscribe to alert-group configuration
daily periodic subscribe to alert-group telemetry
aes encryption password
Cryptochecksum:6f99e1277a392a926d04735c7f6a8c50
: end

You provided the log messages are NAT and messages from tell-establishment of connections, not blocks.

They are a normal part of the firewall, clean the table xlate and connections once they have expired.

Tags: Cisco Security

Similar Questions

Maybe you are looking for

  • I just new HP Pavilion - 17z product M7e01av.

    Ordered to the blue tooth, but he continues to seek and does not connect to devices that it locates.

  • VI cloned

    I saved a reading of the worksheet vi of the file in the user's library.  When I reference from another vi he clones himself - why?

  • Add Device sees wireless but printer is plugged and can reach the HTTP page on wire

    I installed my new 8000 Officejet Pro A809 with an ethernet but when I run the Wizard "Add Device" of HP, it trys to install as wireless even though I select wired and the installation fails. I can see the page http for the printer and it presents in

  • VPN site to site ASA and SSL VPN

    Hello Already configured vpn site to site for both sites. Now, I try to configure vpn remote access to one site. But I'm starting to config some command like below to access remote vpn, the existing site-to-site vpn disconnected auto. No crypto ipsec

  • Open CL for Adobe Premiere Pro CS 5.5

    How can I use AMD Radeon R9 M290X with 4 GB within a 5 K with first Pro CS 5.5 iMac to use the GPU supporting the Mercury playback engine.Y at - it a patch or an update for CS 5.5 available that support it. I want to stay with CS 5.5 now, I am happy