# Cisco ASA module Source and Destination IP incorrect **URL:** \ **Category:** Beats\ **Tags:** filebeat\ **Created:** [December 4, 2020, 2:04pm UTC](https://discuss.elastic.co/t/cisco-asa-module-source-and-destination-ip-incorrect/257658 "2020-12-04T14:04:04Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ajesh](https://avatars.discourse-cdn.com/v4/letter/a/ecd19e/32.png) [@ajesh](https://discuss.elastic.co/u/ajesh)\ **Post date:** [December 4, 2020, 2:04pm UTC](https://discuss.elastic.co/t/cisco-asa-module-source-and-destination-ip-incorrect/257658/1 "2020-12-04T14:04:04Z")
Dear Team, We are currently ingesting Cisco ASA logs to our elasticsearch cluster using cisco asa module [ECS] which comes with filebeat. After verifying the logs in elasticsearch we could understand that Source.address and destination.address is reversed. Please see the snippet below. Firewall Logs - Showing the correct flow ![FW_logs](https://us1.discourse-cdn.com/elastic/original/3X/b/4/b4731c94a3ce26555a7cc9b904fd65a448e1a087.jpeg) Elasticsearch Discovery log console. - Showing the destination IP as source and Source which is our Internal IP as destination ![elastic_logs](https://us1.discourse-cdn.com/elastic/original/3X/2/c/2cda7faafaab220cd783f27e0c04c4e3a6048460.jpeg) We have checked this on multiple firewalls we have and we see this on all the cisco asa firewalls integrated to elasticsearch cluster Please let me know if we can do anything to correct this Thanks, Ajesh ---
**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\ **Post date:** [January 1, 2021, 4:04pm UTC](https://discuss.elastic.co/t/cisco-asa-module-source-and-destination-ip-incorrect/257658/2 "2021-01-01T16:04:21Z")
This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.