Cisco ASA Audit Event: 324301

324301: Radius accounting request has bad header

Cisco ASA is a security device that provides the combined capabilities of a firewall, an antivirus, and an intrusion prevention system. It also facilitates virtual private network (VPN) connections. It helps to detect threats and stop attacks before they spread through the network.

Message: %ASA-3-324301: Radius Accounting Request has a bad header lengthhdr_len , packet length pkt_len.

Event 324301 is generated when the accounting request message has a header length that is not the same as the actual packet length. This would cause the packet processing to stop. The length indicated in the request header and the actual packet length are specified in the message.

How could you resolve this situation?

Make sure the packet was not spoofed. If the packet is legitimate, then capture the packet and make sure the header length is incorrect, as indicated in the message. If the header length is correct, and if this event keeps recurring, contact Cisco TAC.

Cisco ASA Auditing Tool

EventLog Analyzer is a comprehensive log management software with which you can centrally collect, analyze, and manage logs from all the different log sources in your network. You also get reports and alerts on your network security, making it a power-packed IT security tool.