AnyConnect users try to connect broadcast in the same network

[polinaovsyannikova]

Hello, I have strange situation 

My topology is:

Anyconnect User --> Asa+ACS (5.5)+AD --> inside Network

When User connecting to ASA by anyconnect client, i see  many many rows with strange logs:

4|Oct 27 2018 13:12:33|106103: access-list AAA-user-polinao-19667502 denied udp for user 'polinao' outside/10.XX.121.45(137) -> outside/10.XX.121.63(137) hit-cnt 1 first hit [0xea7e4b66, 0x0]

Where 10.xx.121.63 - broadcast address of network  for anyconnect clients - 10.xx.121.0/26

If someone faced a similar situation, please tell me what it can be connected with. Thanks

[Richard Burts]

You have not given us much information to work with. But the most significant clue in what you have posted is that they are attempting access on UDP port 137 which is used for netBIOS. netBIOS frequently tries to identify resources by sending broadcast frames. It is apparent that the access list assigned for this user is not permitting those netBIOS broadcast requests.

HTH

Rick