topic Re: Next CLI command to determine what ACL is dropping traffic? in Network Security

Next CLI command to determine what ACL is dropping traffic?

Alan Inman — Mon, 04 Jan 2021 22:55:19 GMT

Hey, pros, I've determined that an Implicit ACL is causing my Mobile32 traffic to drop in Phase 3, BUT it's not so kind as to give me which rule is dropping the traffic. If you're me, what's your next command? What command would you enter to see what ACL is dropping traffic for Mobile32?

Thank you all!

Re: Next CLI command to determine what ACL is dropping traffic?

TJ-20933766 — Tue, 05 Jan 2021 00:29:49 GMT

Create a packet capture that only collects dropped packets due to an ACL:

ASA5508# capture mycapture type asp-drop acl-drop

Next view the packet capture to see what traffic is getting dropped which might lead you to the ACL that needs tweaking:

ASA5508# show capture mycapture
5 packets captured
   1: 18:25:42.987879       1.1.1.1.43605 > 2.2.2.2.34577: S 431469340:431469340(0) win 1024 Drop-reason: (acl-drop) Flow is denied by configured rule

Re: Next CLI command to determine what ACL is dropping traffic?

setian_london — Tue, 05 Jan 2021 17:55:09 GMT

You can use the command

>system support trace

the result tells you which policy generates the block.

example.

more information

https://www.cisco.com/c/en/us/support/docs/security/firepower-ngfw/212321-clarify-the-firepower-threat-defense-acc.html