I have just installed and setup splunk to pull my syslogs from my ASA 5510 firewall. All records are flowing correctly and I can search for various entries within the log. However, I have one major issue. Whenever I shutdown the splunk service all access to the internet ceases. On the ASA log I receive a message stating "no new connections" and no one can access the internet. In bound connections are unaffected.
Any help would be greatly appreciated.
Some Cisco Firewalls will stop passing traffic if the logging device is unavailable. Consider the following quote from Cisco's documentation regarding TCP syslog:
The %ASA-3-201008: Disallowing new connections error message is seen when ASA is unable to contact syslog server and no new connections are allowed...This message appears when you have enabled TCP system log messaging and the syslog server cannot be reached.
If the syslog server goes down and the TCP logging is configured either use the logging permit-hostdown command or switch to UDP logging.
To fix it either:
UGH, I knew that. Sometimes you go brain dead on the simplest things. Thanks so much for the reply. I hope i awarded you points correctly, this was my first post here.