Internet access is denied when the splunk service is stopped

[l8nite4me]

I have just installed and setup splunk to pull my syslogs from my ASA 5510 firewall. All records are flowing correctly and I can search for various entries within the log. However, I have one major issue. Whenever I shutdown the splunk service all access to the internet ceases. On the ASA log I receive a message stating "no new connections" and no one can access the internet. In bound connections are unaffected.

Any help would be greatly appreciated.

Thanks

[LukeMurphey · Accepted solution]

Some Cisco Firewalls will stop passing traffic if the logging device is unavailable. Consider the following quote from Cisco's documentation regarding TCP syslog:

The %ASA-3-201008: Disallowing new connections error message is seen when ASA is unable to contact syslog server and no new connections are allowed...This message appears when you have enabled TCP system log messaging and the syslog server cannot be reached.

If the syslog server goes down and the TCP logging is configured either use the logging permit-hostdown command or switch to UDP logging.

[Source: Cisco]

To fix it either:

1. Change the configuration of the device to continue passing traffic when the logging host is down (permit-hostdown)
2. Switch to UDP so that the firewall does not know when the logging device is unavailable (since UDP does not have packet acknowledgements like TCP)

[l8nite4me]

UGH, I knew that. Sometimes you go brain dead on the simplest things. Thanks so much for the reply. I hope i awarded you points correctly, this was my first post here.

Thanks again