Implicit deny

DineshRajan2315 — Fri, 25 Sep 2020 13:51:26 GMT

Hi People,

I am using ASA ASA5520 SW version 8.2(5)57

I have many subinterfaces in my ASA. The relevant ones are below,

GigabitEthernet0/1.6 DMZ 100

GigabitEthernet0/1.56 WITNESS 74

I have allowed traffic from an IP whose route is pointing to DMZ, to an IP whose route is pointing to WITNESS. But Firewall is dropping the traffic.

The hitcount on all ACLs in the DMZ interface is 0

pac input DMZ tcp 165.136.158.4 1234 155.17.240.140 443 detailed

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x88bb9440, priority=12, domain=capture, deny=false
hits=43723345, user_data=0x7615d720, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x714f5290, priority=1, domain=permit, deny=false
hits=50443702565, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 155.17.240.128 255.255.255.224 WITNESS

Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7f992168, priority=11, domain=permit, deny=true
hits=45899286, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: WITNESS
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Interzone and intrazone same security traffic is permitted(just in case)

Can you please help me to understand why firewall is showing this behavior ?

Regards,

Dinesh

Issue resolved.

access-group dmz-15 in interface DMZ

Must have created in the access-group dmz-15 instead of DMZ. My mistake.

topic Implicit deny in Network Security

Implicit deny