Cisco ASA syslog messages, reversed source and destination for outbound communication?

Question

I'm writing my own parser for transforming the syslog output from the ASA firewall into CSV for deeper analysis. What I don't get, is why the "for" and "to" machines are switched when the traffic is outbound.

Let's say I have a DMZ interface which is the "out" zone and a LAN interface which is the "in" zone.

When I RDP from an outside pc into an inside PC I see this:

%ASA-6-302013: Built inbound TCP connection 21955057 for DMZ:192.168.1.110/56388 (192.168.1.110/56388) to LAN:192.168.2.110/3389 (192.168.2.110/3389)

As expected the computer 192.168.1.110 in the DMZ is making a RDP connection from a random port to TCP/3389 of the computer 192.168.2.110 in the LAN network. The connection is inbound because it comes from the outer interface the firewall into the network protected by it.

What happens though when I make a connection from the computer inside the LAN to a computer in the DMZ?

%ASA-6-302013: Built outbound TCP connection 13538633 for DMZ:192.168.1.110/3389 (192.168.1.110/3389) to LAN:192.168.2.110/50927 (192.168.2.110/50927)

The "for" and "to" stay the same and the only way to know that the communication started from the "to" host is the outbound keyword in the message (other than the ports, but it's not always obvious).

So what I did in my parser is writing regular expressions to extract the address and port after the "for" and put it in my "source" columns, same for the "to" and label them as "destination" and switch the source with the destination if the communication is inbound

Am I doing this right? Isn't this syntax convoluted and misleading? Things get even worse with ICMP as there are echo request and echo replies and finding out who's pinging who gets even more complicated.

Answer 1

Ok apparently that's what the Splunk plugin does as well. See "Splunk Add-on for Cisco ASA" https://splunkbase.splunk.com/app/1620/

# direction is inbound
[cisco_asa_message_id_302013_302015_inbound]
REGEX = -30201[35]:\s*(\S+)\s+([Ii]nbound)\s+(\S+)(?:\s+connection)?\s+(\d+)\s+for\s+([^:\s]+)\s*:\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*(?:\(\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*\)(?:\s*\(\s*(?:([\S^\\\[]+)\s*[\\\[]\s*)?([^\s\|\)]+)(?:[^\]]+\])?\s*\))?\s+to\s+([^:\s]+)\s*:\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})\s*\(\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*\)(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_]+)\s*\))?(?:\s*\(\s*([^\)\s]+)\s*\))?|\(\s*(\S+)\s*\))
FORMAT = action::$1 direction::$2 transport::$3 session_id::$4 src_interface::$5 src_ip::$6 src_host::$7 src_port::$8 src_translated_ip::$9 src_translated_host::$10 src_translated_port::$11 src_nt_domain::$12 src_user::$13 dest_interface::$14 dest_ip::$15 dest_host::$16 dest_port::$17 dest_translated_ip::$18 dest_translated_host::$19 dest_translated_port::$20 dest_nt_domain::$21 dest_user::$22 user::$23 user::$24

# direction is outbound - source and destination fields are swapped
[cisco_asa_message_id_302013_302015_outbound]
REGEX = -30201[35]:\s*(\S+)\s+([Oo]utbound)\s+(\S+)(?:\s+connection)?\s+(\d+)\s+for\s+([^:\s]+)\s*:\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*(?:\(\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*\)(?:\s*\(\s*(?:([\S^\\\[]+)\s*[\\\[]\s*)?([^\s\|\)]+)(?:[^\]]+\])?\s*\))?\s+to\s+([^:\s]+)\s*:\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d{1,5})\s*\(\s*(?:((?:[\d+\.]+|[a-fA-F0-9]*:[a-fA-F0-9]*:[a-fA-F0-9:]*))|(\S+))\s*\/\s*(\d+)\s*\)(?:\s*\(\s*(?:([\S^\\]+)\\)?([\w\-_]+)\s*\))?(?:\s*\(\s*([^\)\s]+)\s*\))?|\(\s*(\S+)\s*\))
FORMAT = action::$1 direction::$2 transport::$3 session_id::$4 dest_interface::$5 dest_ip::$6 dest_host::$7 dest_port::$8 dest_translated_ip::$9 dest_translated_host::$10 dest_translated_port::$11 dest_nt_domain::$12 dest_user::$13 src_interface::$14 src_ip::$15 src_host::$16 src_port::$17 src_translated_ip::$18 src_translated_host::$19 src_translated_port::$20 src_nt_domain::$21 src_user::$22 user::$23 user::$24