Table Of Contents
System Log Messages
This chapter lists the Cisco PIX Firewall system log messages. The messages are listed numerically by message code.
Note
The messages shown in this guide apply to Cisco PIX Firewall Version 6.3 and higher. When a number is skipped from a sequence, the message is no longer in the PIX Firewall code.
This chapter includes the following sections:
Messages 101001 to 199005
This section contains messages from 101001 to 199005.
101001
Error Message %PIX-1-101001: (Primary) Failover cable OK.Explanation This is a failover message. This message reports that the failover cable is present and functioning correctly. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
101002
Error Message %PIX-1-101002: (Primary) Bad failover cable.Explanation This is a failover message. This message reports that the failover cable is present but not functioning correctly. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Replace the failover cable.
101003, 101004
Error Message %PIX-1-101003: (Primary) Failover cable not connected (this unit).Error Message %PIX-1-101004: (Primary) Failover cable not connected (other unit).Explanation Both instances are failover messages. These messages are logged when failover mode is enabled, but the failover cable is not connected to one unit of the failover pair. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Connect the failover cable to both units of the failover pair.
101005
Error Message %PIX-1-101005: (Primary) Error reading failover cable status.Explanation This is a failover message. This message is logged if the failover cable is connected, but the primary unit is unable to determine its status.
Recommended Action Replace the cable.
102001
Error Message %PIX-1-102001: (Primary) Power failure/System reload other side.Explanation This is a failover message. This message is logged if the primary unit detects a power failure on the other unit. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Verify that the secondary unit is powered on and that power cables are properly connected.
103001
Error Message %PIX-1-103001: (Primary) No response from other firewall (reason code = code).Explanation This is a failover message. This message is logged if the primary unit is unable to communicate with the secondary unit over the failover cable. "(Primary)" can also be listed as "(Secondary)" for the secondary unit. Table 2-1 lists the Reason Codes and the descriptions to determine why the failover occurred.
Recommended Action Verify the failover cable is connected properly and both units have the same hardware, software, and configuration; otherwise contact Cisco TAC.
103002
Error Message %PIX-1-103002: (Primary) Other firewall network interface interface_number OK.Explanation This is a failover message. This message is logged when the primary unit detects that the network interface on the secondary unit is okay. "(Primary)" can also be listed as "(Secondary)" for the secondary unit. Refer to Table 1-4 in Chapter 1, "Introduction," for possible values for the interface_number variable.
Recommended Action None required.
103003
Error Message %PIX-1-103003: (Primary) Other firewall network interface interface_number failed.Explanation This is a failover message. This message is logged if the primary unit detects a bad network interface on the secondary unit. "(Primary)" can also be listed as "(Secondary)" for the secondary unit. Refer to Table 1-4 on page 1-17 for possible values for the interface_number variable.
Recommended Action Check the network connections on the secondary unit. Also, check the network hub connection. If necessary, replace the failed network interface.
103004
Error Message %PIX-1-103004: (Primary) Other firewall reports this firewall failed.Explanation This is a failover message. This message is logged if the primary unit receives a message from the secondary unit indicating that the primary has failed. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Verify the status of the primary unit.
103005
Error Message %PIX-1-103005: (Primary) Other firewall reporting failure.Explanation This is a failover message. This message is logged if the secondary unit reports a failure to the primary unit. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Verify the status of the secondary unit.
104001, 104002
Error Message %PIX-1-104001: (Primary) Switching to ACTIVE (cause: string).Error Message %PIX-1-104002: (Primary) Switching to STNDBY (cause: string).Explanation Both instances are failover messages. These messages usually are logged when you force the pair to switch roles, either by entering the failover active command on the secondary unit, or the no failover active command on the primary unit. "(Primary)" can also be listed as "(Secondary)" for the secondary unit. Possible values for the string variable are as follows:
–
–
–
–
–
–
Recommended Action If the message occurs because of manual intervention, no action is required. Otherwise, use the cause reported by the secondary unit to verify the status of both units of the pair.
104003
Error Message %PIX-1-104003: (Primary) Switching to FAILED.Explanation This is a failover message. This message is logged when the primary unit fails.
Recommended Action Check the system log messages for the primary unit for an indication of the nature of the problem (see message 104001). "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
104004
Error Message %PIX-1-104004: (Primary) Switching to OK.Explanation This is a failover message. This message is logged when a previously failed unit now reports that it is operating again. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
105001
Error Message %PIX-1-105001: (Primary) Disabling failover.Explanation This is a failover message. This message is logged when you enter the no failover command on the console. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
105002
Error Message %PIX-1-105002: (Primary) Enabling failover.Explanation This is a failover message. This message is logged when you enter the failover command with no arguments on the console, after having previously disabled failover. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
105003
Error Message %PIX-1-105003: (Primary) Monitoring on interface interface_name waitingExplanation This is a failover message. The firewall is testing the specified network interface with the other unit of the failover pair. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required. The firewall monitors its network interfaces frequently during normal operations.
105004
Error Message %PIX-1-105004: (Primary) Monitoring on interface interface_name normalExplanation This is a failover message. The test of the specified network interface was successful. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
105005
Error Message %PIX-1-105005: (Primary) Lost Failover communications with mate on interface interface_name.Explanation This is a failover message. This message is logged if this unit of the failover pair can no longer communicate with the other unit of the pair. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Verify that the network connected to the specified interface is functioning correctly.
105006, 105007
Error Message %PIX-1-105006: (Primary) Link status `Up' on interface interface_name.Error Message %PIX-1-105007: (Primary) Link status `Down' on interface interface_name.Explanation Both instances are failover messages. These messages report the results of monitoring the link status of the specified interface. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action If the link status is down, verify that the network connected to the specified interface is operating correctly.
105008
Error Message %PIX-1-105008: (Primary) Testing interface interface_name.Explanation This is a failover message. This message is logged when the firewall tests a specified network interface. This testing is performed only if the firewall fails to receive a message from the standby unit on that interface after the expected interval. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required.
105009
Error Message %PIX-1-105009: (Primary) Testing on interface interface_name {Passed|Failed}.Explanation This is a failover message. This message reports the result (either "Passed" or "Failed") of a previous interface test. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action None required if the result is "Passed." If the result is "Failed," you should check the network cable connection to both failover units, that the network itself is functioning correctly, and verify the status of the standby unit.
105010
Error Message %PIX-3-105010: (Primary) Failover message block alloc failedExplanation Block memory was depleted. This is a transient message and the firewall should recover. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Use the show blocks command to monitor the current block memory.
105011
Error Message %PIX-1-105011: (Primary) Failover cable communication failureExplanation The failover cable is not permitting communication between the primary and secondary units. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Ensure that the cable is properly connected.
105020
Error Message %PIX-1-105020: (Primary) Incomplete/slow config replicationExplanation When a failover occurs, the active PIX Firewall detects a partial configuration in memory. Normally, this is caused by an interruption in the replication service. "(Primary)" can also be listed as "(Secondary)" for the secondary unit.
Recommended Action Once the failover is detected by the PIX Firewall, the PIX Firewall automatically reloads itself and loads configuration from Flash memory and/or resyncs with another PIX Firewall. If failovers happen continuously, check the failover configuration and make sure both PIX Firewall units can communicate with each other.
105031
Error Message %PIX-1-105031: Failover LAN interface is upExplanation LAN failover interface link is up.
Recommended Action None required.
105032
Error Message %PIX-1-105032: LAN Failover interface is downExplanation LAN failover interface link is down.
Recommended Action Check the connectivity of the LAN failover interface. Make sure the speed/duplex setting is correct.
105034
Error Message %PIX-1-105034: Receive a LAN_FAILOVER_UP message from peer.Explanation The peer has just booted and sent the initial contact message.
Recommended Action None required.
105035
Error Message %PIX-1-105035: Receive a LAN failover interface down msg from peer.Explanation The peer LAN failover interface link is down. The unit switches to active mode if it is in standby mode.
Recommended Action Check the connectivity of the peer's LAN failover interface.
105036
Error Message %PIX-1-105036: PIX dropped a LAN Failover command message.Explanation The firewall dropped an unacknowledged LAN failover command message, indicating a connectivity problem on the LAN failover interface.
Recommended Action Check that the LAN interface cable is connected.
105037
Error Message %PIX-1-105037: The primary and standby units are switching back and forth as the active unit.Explanation The primary and standby units are switching back and forth as the active unit, indicating a LAN failover connectivity problem or software bug.
Recommended Action Check that the LAN interface cable is connected.
106001
Error Message %PIX-2-106001: Inbound TCP connection denied from IP_address/port to IP_address/port flags tcp_flags on interface interface_nameExplanation This is a connection-related message. This message occurs when an attempt to connect to an inside address is denied by your security policy. Possible tcp_flags values correspond to the flags in the TCP header that were present when the connection was denied. For example, a TCP packet arrived for which no connection state exists in the PIX Firewall, and it was dropped. The tcp_flags in this packet are FIN and ACK.
The tcp_flags are as follows:–
–
–
–
–
–
Recommended Action None required.
106002
Error Message %PIX-2-106002: protocol Connection denied by outbound list acl_ID src inside_address dest outside_addressExplanation This is a connection-related message. This message is logged if the specified connection fails because of an outbound deny command statement. The protocol variable can be ICMP, TCP, or UDP.
Recommended Action Use the show outbound command to check outbound lists.
106006
Error Message %PIX-2-106006: Deny inbound UDP from outside_address/outside_port to inside_address/inside_port on interface interface_name.Explanation This is a connection-related message. This message is logged if an inbound UDP packet is denied by your security policy.
Recommended Action None required.
106007
Error Message %PIX-2-106007: Deny inbound UDP from outside_address/outside_port to inside_address/inside_port due to DNS {Response|Query}.Explanation This is a connection-related message. This message is logged if a UDP packet containing a DNS query or response is denied.
Recommended Action If the inside port number is 53, it is likely that the inside host is set up as a caching nameserver. Add an access-list command statement to permit traffic on UDP port 53. If the outside port number is 53, the most likely cause is that a DNS server was too slow to respond, and the query was answered by another server.
106010
Error Message %PIX-3-106010: Deny inbound protocol src interface_name:dest_address/dest_port dst interface_name:source_address/source_portExplanation This is a connection-related message. This message is logged if an inbound connection is denied by your security policy.
Recommended Action Modify the security policy if traffic should be permitted. If the message occurs at regular intervals, contact the remote peer administrator.
106011
Error Message %PIX-3-106011: Deny inbound (No xlate) stringExplanation The message will appear under normal traffic conditions if there are internal users that are accessing the Internet via a web browser. Anytime a connection is reset, when the host at the end of the connection sends a packet after the firewall receives the reset, this message will appear. It can typically be ignored.
Recommended Action Disable this syslog message from getting logged to the syslog server by entering the no logging message 106011 command.
106012
Error Message %PIX-2-106012: Deny IP from IP_address to IP_address, IP options hex.Explanation This is a packet integrity check message. An IP packet was seen with IP options. Because IP options are considered a security risk, the packet was discarded.
Recommended Action Contact the remote host system administrator to determine the problem. Check the local site for loose source or strict source routing.
106013
Error Message %PIX-2-106013: Dropping echo request from IP_address to PAT address IP_addressExplanation This message is logged when the firewall discards an inbound ICMP Echo Request packet with a destination address that corresponds to a PAT global address. It is discarded because the inbound packet cannot specify which PAT host should receive the packet.
Recommended Action None required.
106014
Error Message %PIX-3-106014: Deny inbound icmp src interface_name: IP_address dst interface_name: IP_address (type dec, code dec)Explanation This message is logged when the firewall denies any inbound ICMP packet access. By default, all ICMP packets are denied access unless specifically permitted using the conduit permit icmp command. Now that the icmp command has been implemented, the conduit command has been deprecated and is no longer guaranteed to work properly.
Recommended Action None required.
106015
Error Message %PIX-6-106015: Deny TCP (no connection) from IP_address/port to IP_address/port flags tcp_flags on interface interface_name.Explanation This message is logged when the firewall discards a TCP packet that has no associated connection in the firewall unit's connection table. The firewall looks for a SYN flag in the packet, which indicates a request to establish a new connection. If the SYN flag is not set, and there is not an existing connection, the firewall discards the packet.
Recommended Action None required unless the firewall receives a large volume of these invalid TCP packets. If this is the case, trace the packets to the source and determine the reason these packets were sent.
106016
Error Message %PIX-2-106016: Deny IP spoof from (IP_address) to IP_address on interface interface_name.Explanation This message is generated when a packet arrives at the PIX interface that has a destination IP address of 0.0.0.0 and a destination MAC address of the PIX interface. In addtion, this message is logged when the firewall discards a packet with an invalid source address. Invalid source addresses are those addresses belonging to the following:
–
–
–
Furthermore, if the sysopt connection enforcesubnet command is enabled, the PIX firewall discards packets with a source address belonging to the destination subnet from traversing the firewall and logs this message.
To further enhance spoof packet detection, use the icmp command to configure the firewall to discard packets with source addresses belonging to the internal network.Recommended Action Determine if an external user is trying to compromise the protected network. Check for misconfigured clients.
106017
Error Message %PIX-2-106017: Deny IP due to Land Attack from IP_address to IP_addressExplanation This message appears when the firewall receives a packet with the IP source address equal to the IP destination, and the destination port need not be equal to the source port. This indicates a spoofed packet designed to attack systems. This attack is referred to as a Land Attack.
Recommended Action If this message persists, an attack may be in progress. The packet does not provide enough information to determine where the attack originates.
106018
Error Message %PIX-2-106018: ICMP packet type ICMP_type denied by outbound list acl_ID src inside_address dest outside_addressExplanation This message is logged because the outgoing ICMP packet with type ICMP_type from local host inside_address to foreign host outside_address is denied by outbound list acl_ID.
Recommended Action None required.
106020
Error Message %PIX-2-106020: Deny IP teardrop fragment (size = number, offset = number) from IP_address to IP_addressExplanation The firewall discarded an IP packet with a teardrop signature containing either a small offset or fragment overlapping. This is a hostile event to circumvent the firewall or an Intrusion Detection System.
Recommended Action Contact the remote peer administrator or escalate this issue according to your security policy.
106021
Error Message %PIX-1-106021: Deny protocol reverse path check from source_address to dest_address on interface interface_nameExplanation Someone is attempting to spoof an IP address on an inbound connection. Unicast Reverse Path Forwarding (Unicast RPF), also known as reverse route lookup, detected a packet that does not have a source address represented by a route and assumes that it is part of an attack on your firewall.
Recommended Action This message appears when you have enabled Unicast Reverse Path Forwarding with the ip verify reverse-path command. This feature works on packets input to an interface; if it is configured on the outside, then the firewall checks packets arriving from the outside.
The firewall looks up a route based on the source_address. If an entry is not found and a route is not defined, then this syslog message appears and the connection is dropped.
If there is a route, the firewall checks which interface it corresponds to. If the packet arrived on another interface, it is either a spoof or there is an asymmetric routing environment that has more than one path to a destination. The firewall does not support asymmetric routing.
If configured on an internal interface, the firewall checks static route command statements or RIP and if the source_address is not found, then an internal user is spoofing their address.
An attack is in progress. With this feature enabled, no user action is required. The firewall repels the attack.
106022
Error Message %PIX-1-106022: Deny protocol connection spoof from source_address to dest_address on interface interface_nameExplanation This message only appears if a connection exists and a packet matching the connection arrives on a different interface than the interface the connection began on.
For example, if a user starts a connection on the inside interface, but the firewall detects the same connection arriving on a perimeter interface, the firewall has more than one path to a destination. This is known as asymmetric routing and is not supported on the firewall.
Alternately, an attacker is attempting to append packets from one connection to another as a way to break into the firewall. In either case, the firewall displays this message and drops the connection.
Recommended Action This message appears when the ip verify reverse-path command is not configured. Ensure routing is not asymmetric.
106023
Error Message %PIX-4-106023: Deny protocol src [interface_name:source_address/source_port] dst interface_name:dest_address/dest_port [type {string}, code {code}] by access_group acl_IDExplanation An IP packet was denied by the ACL. This message displays even if you do not have the log option enabled for an ACL.
Recommended Action If messages persist from the same source address, messages could indicate a foot printing or port scanning attempt. Contact the remote host administrators.
106028
Error Message %PIX-2-106028: Dropping invalid echo {request|reply} from interface:address to interface:address, {destination|source} address address should not match dynamic port translation, real interface:address/ICMP-ID, mapped interface:address/ICMP-IDExplanation An ICMP echo request or echo reply message is dropped because of an invalid destination or source address. NAT prohibits one host from pinging another host that is configured for dynamic port translation.
Recommended Action Check the adjacent device for routing misconfiguration. If this message occurs on a regular interval, and from an echo reply message, check the payload for a possible covert channel.
106100
Error Message %PIX-n-106100: access-list acl_ID {permitted | denied | est-allowed} protocol interface_name/source_address(source_port) -> interface_name/dest_address(dest_port) hit-cnt number ({first hit | number-second interval})Explanation This message reports when packets match an ACL statement, if you configured the log option for the access-list command. The message level depends on the level set in the access-list command (by default, the level is 6). The message indicates either the initial occurrance or the total number of occurrances during an interval. This message provides more information than message 106023, which only logs denied packets, and does not include the hit count or a configurable level. See the following descriptions:
–
–
–
–
–
–
–
–
–
–
Recommended Action None required.
106101
Error Message %PIX-1-106101 The number of ACL log deny-flows has reached limit (number).Explanation If you configured the log option for an ACL deny statement (access-list id deny command), and a traffic flow matches the ACL statement, the firewall caches the flow information. When the number of matching flows that are cached on the firewall exceeds the user-configured limit (access-list deny-flow-max command), this message is logged. See the following description:
–
Recommended Action None required. This message might be generated as a result of a DoS attack.
107001
Error Message %PIX-1-107001: RIP auth failed from IP_address: version=number, type=string, mode=string, sequence=number on interface interface_nameExplanation This is an alert log message. The firewall received a RIP reply message with bad authentication. This could be due to misconfiguration on the router or the firewall, or it could be an unsuccessful attempt to attack the firewall routing table.
Recommended Action This may be an attack and should be monitored. If you are not familiar with the source IP address listed in this message, change your RIP authentication keys between trusted entities. An attacker may be trying to deduce the existing keys.
107002
Error Message %PIX-1-107002: RIP pkt failed from IP_address: version=number on interface interface_nameExplanation This is an alert message. This could be a router bug, a packet with non-RFC values inside, or a malformed entry. This should not happen, and may be an attempt to exploit the PIX Firewall unit's routing table.
Recommended Action This may be an attack and should be monitored. The packet has passed authentication, if enabled, and bad data is in the packet. The situation should be monitored and the keys should be changed if there are any doubts as to the originator of the packet.
108002
Error Message %PIX-2-108002: SMTP replaced string: out source_address in inside_address data: stringExplanation This is a Mail Guard (SMTP) message generated by the fixup protocol smtp command. This message is logged if the PIX Firewall replaces an invalid character in an email address with a space.
Recommended Action None required.
109001
Error Message %PIX-6-109001: Auth start for user user from inside_address/inside_port to outside_address/outside_portExplanation This is a AAA message. This message is logged if the PIX Firewall is configured for AAA and detects an authentication request by the specified user.
Recommended Action None required.
109002
Error Message %PIX-6-109002: Auth from inside_address/inside_port to outside_address/outside_port failed (server IP_address failed) on interface interface_name.Explanation This is a AAA message. This message is logged if an authentication request fails because the specified authentication server cannot be contacted by the PIX Firewall.
Recommended Action Check that the authentication daemon is running on the specified authentication server.
109003
Error Message %PIX-6-109003: Auth from inside_address to outside_address/outside_port failed (all servers failed) on interface interface_name.Explanation This is a AAA message. This message is logged if no authentication server can be found.
Recommended Action Ping the authentication server(s) from the PIX Firewall. Make sure the daemon(s) are running.
109005
Error Message %PIX-6-109005: Authentication succeeded for user `user' from inside_address/inside_port to outside_address/outside_port on interface interface_name.Explanation This is a AAA message. This message is logged when the specified authentication request succeeds.
Recommended Action None required.
109006
Error Message %PIX-6-109006: Authentication failed for user `user' from inside_address/inside_port to outside_address/outside_port on interface interface_name.Explanation This is a AAA message. This message is logged if the specified authentication request fails, possibly because of an incorrect password.
Recommended Action None required.
109007
Error Message %PIX-6-109007: Authorization permitted for user `user' from inside_address/inside_port to outside_address/outside_port on interface interface_name.Explanation This is a AAA message. This message is logged when the specified authorization request succeeds.
Recommended Action None required.
109008
Error Message %PIX-6-109008: Authorization denied for user `user' from source_address/source_port to destination_address/destination_port on interface interface_name.Explanation This is a AAA message. This message is logged if a user is not authorized to access the specified address, possibly because of an incorrect password. This message works only with TACACS+ protocol.
Recommended Action None required.
109010
Error Message %PIX-3-109010: Auth from inside_address/inside_port to outside_address/outside_port failed (too many pending auths) on interface interface_name.Explanation This is a AAA message. This message is logged if an authentication request cannot be processed because the server has too many requests pending.
Recommended Action Check to see if the authentication server is too slow to respond to authentication requests. Enable Flood Defender with the floodguard enable command.
109011
Error Message %PIX-2-109011: Authen Session Start: user 'user', sid numberExplanation An authentication session started between the host and the firewall and has not yet completed.
Recommended Action None required.
109012
Error Message %PIX-5-109012: Authen Session End: user 'user', sid number, elapsed number secondsExplanation The authentication cache has timed out. Users must reauthenticate on their next connection. You can change the duration of this timer with the timeout uauth command.
Recommended Action None required.
109013
Error Message %PIX-3-109013: User must authenticate before using this serviceExplanation The user must be authenticated before using the service.
Recommended Action Authenticate using FTP, Telnet, or HTTP before using the service.
109014
Error Message %PIX-7-109014: uauth_lookup_net fail for uauth_in()Explanation A request to authenticate did not have a corresponding request for authorization.
Recommended Action Ensure that both the aaa authentication and aaa authorization command statements are included in the configuration.
Recommended Action Ensure that both the aaa authentication and aaa authorization command statements are included in the configuration.
109016
Error Message %PIX-3-109016: Can't find authorization ACL acl_ID on 'PIX' for user 'user'Explanation The access control list (ACL) specified on the AAA server for this user does not exist on the firewall. This error can occur if you configure the AAA server before you configure the firewall. The Vender-Specific Attribute (VSA) on your AAA server might be one of the following values:
–
–
–
Recommended Action Add the ACL to the firewall, making sure to use the same name specified on the AAA server.
109017
Error Message %PIX-4-109017: User at IP_address exceeded auth proxy connection limit (max)Explanation A user has exceeded the user authentication proxy limit, and has opened too many connections to the proxy.
Recommended Action Increase the proxy limit by entering the aaa proxy-limit proxy_limit command, or make the user close unused connections. If the error persists, it may indicate a possible DoS attack.
109018
Error Message %PIX-3-109018: Downloaded ACL acl_ID is emptyExplanation The downloaded authorization access list has no ACEs. This might be caused by the misspelled attribute string 'ip:inacl#' or omission of the access-list command.
junk:junk# 1=permit tcp any any eq junk" "ip:inacl#1="Recommended Action Correct the ACL elements that have the indicated error on the AAA server.
109019
Error Message %PIX-3-109019: Downloaded ACL acl_ID has parsing error; ACE stringExplanation An error is encountered during parsing the sequence number NNN in the attribute string 'ip:inacl#NNN=' of a downloaded authorization access list. The reasons include: - missing '=' - contains non-numeric, non-space characters between '#' and '=' - NNN is greater than 999999999.
ip:inacl# 1 permit tcp any anyip:inacl# 1junk2=permit tcp any anyip:inacl# 1000000000=permit tcp any anyRecommended Action Correct the ACL element that has the indicated error on the AAA server.
109020
Error Message %PIX-3-109020: Downloaded ACL has config error; ACEExplanation One of the elements of the downloaded authorization access list has a configuration error. The entire text of the element is included in the syslog message. This message is usually caused by an invalid access-list command statement.
ip:inacl# 1=permit junk any anyip:inacl# 1=permit tcp any any eq junkRecommended Action Correct the ACL element that has the indicated error on the AAA server.
109021
Error Message %PIX-7-109021: Uauth null proxy errorExplanation This message indicates an internal User Authentication error.
Recommended Action None required. However, if this error appears repeatedly, contact Cisco TAC.
109022
Error Message %PIX-4-109022: exceeded HTTPS proxy process limitExplanation For each HTTPS authentication, the firewall dedicates a process to service the authentication request. When the number of concurrently running processes exceeds the system-imposed limit, the firewall does not perform the authentication, and this message displays.
Recommended Action None required.
109023
Error Message %PIX-3-109023: User from src_IP_Adress/src_port to dest_IP_Address/dest_port on interface outside must authenticate before using this service.Explanation This is a AAA message. Based on the configured policies, you need to be authenticated before you can use this service (port).
Recommended Action Have the user authenticate using Telnet, FTP or HTTP before attempting to use the above service (port).
109024
Error Message %PIX-6-109024: Authorization denied from source_IP_Address/src_port to dest_IP_Address/dest_port (not authenticated) on interface interface_name using protocolExplanation (not authenticated) on interface interface_name using protocol(not authenticated) on interface interface_name using protocol. This is a AAA message. This message is logged if the PIX Firewall is configured for AAA and a user attempted to make a TCP connection across the PIX Firewall without prior authentication.
Recommended Action None required.
109025
Error Message %PIX-6-109025: Authorization denied (acl=acl_ID) for user 'user' from source_address/source_port to dest_address/dest_port on interface interface_name using protocolExplanation The access list check failed; either it matched a deny, or it matched nothing, such as an implicit deny. Connection denied by user access list acl_ID, which was defined per the AAA authorization policy on CiscoSecure ACS. This message works only with RADIUS protocol.
Recommended Action None required.
110001
Error Message %PIX-6-110001: No route to dest_address from source_addressExplanation This message indicates a route lookup failure. A packet is looking for a destination IP address which is not in the routing table.
Recommended Action Check the routing table and make sure there is a route to the destination.
111002
Error Message %PIX-5-111002: Begin configuration: IP_address writing to deviceExplanation This message is logged when you enter the write command to store your configuration on a device (either floppy, Flash memory, TFTP, the failover standby unit, or the console terminal). The IP_address indicates whether the login was made at the console port or via a Telnet connection.
Recommended Action None required.
111003
Error Message %PIX-5-111003: IP_address Erase configurationExplanation This is a firewall management message. This message is logged when you erase the contents of Flash memory by entering the write erase command at the console. The IP_address indicates whether the login was made at the console port or via a Telnet connection.
Recommended Action After erasing the configuration, reconfigure the firewall and save the new configuration. Alternatively, you can restore information from a configuration that was previously saved, either on floppy or on a TFTP server elsewhere on the network.
111004
Error Message %PIX-5-111004: IP_address end configuration: {FAILED|OK}Explanation This message is logged when you enter the config floppy/memory/ network command, or the write floppy/memory/network/standby command. The IP_address indicates whether the login was made at the console port or via a Telnet connection.
Recommended Action None required if the message ends with OK. If the message indicates a failure, try to fix the problem. For example, if writing to a floppy, ensure that the floppy is not write protected; if writing to a TFTP server, ensure that the server is up.
111005
Error Message %PIX-5-111005: IP_address end configuration: OKExplanation This message is logged when you exit configuration mode. The IP_address indicates whether the login was made at the console port or via a Telnet connection.
Recommended Action None required.
111007
Error Message %PIX-5-111007: Begin configuration: IP_address reading from device.Explanation This message is logged when you enter the reload or configure command to read in a configuration. The device text can be floppy, memory, net, standby, or terminal. The IP_address indicates whether the login was made at the console port or via a Telnet connection.
Recommended Action None required.
111008
Error Message %PIX-5-111008: User user executed the command stringExplanation This syslog message is for accounting purposes. The user entered a command that modified the configuration.
Recommended Action None required.
111009
Error Message %PIX-7-111009:User user executed cmd:stringExplanation This syslog message is for accounting purposes. The user entered a command that does not modify the configuration.
Recommended Action None required.
112001
Error Message %PIX-2-112001: (string:dec) PIX Clear complete.Explanation This message is logged when a request to clear the PIX Firewall configuration has finished. The source file and line number are identified.
Recommended Action None required.
199001
Error Message %PIX-5-199001: PIX reload command executed from telnet (remote IP_address).
