Cisco PIX/ASA Built Outbound Connection event parsing explained

Products

• Security Information Manager

Issue/Introduction

Cisco PIX/ASA Built Outbound Connection event parsing explained.

 

Resolution

With Built Connection events, the key point to understanding them you must look at the Direction rather than the Interface name to Interface name portion of the event.

Here is a detailed explanation.

%PIX|ASA-6-302013: Built {inbound|outbound} TCP connection_id for interface:real-address/real-port (mapped-address/mapped-port) to interface:real-address/real-port (mapped-address/mapped-port) [(user)]

Explanation A TCP connection slot between two hosts was created.
• connection_id is a unique identifier.
•interface, real-address, real-port identify the actual sockets.
•mapped-address, mapped-port identify the mapped sockets.
•user is the AAA name of the user.
If inbound is specified, the original control connection was initiated from the outside. For example, for FTP, all data transfer channels are inbound if the original control channel is inbound. If outbound is specified, the original control connection was initiated from the inside.

For Example; the below event is parsed as Source IP Address as 192.168.10.5 and Destination IP Address as 168.15.3.6

Jan 14 16:10:24 10.1.2.13 Jan 14 2010 12:29:43 SymCiscoApp : %PIX-6-302015: Built outbound UDP connection 414128851 for outside:168.15.3.6/53 (168.15.3.6/53) to inside:192.168.10.5/53 (192.168.10.5/171)