topic Re: ASA VTI source interface packet tracer in Network Security

ASA VTI source interface packet tracer

prestigio391 — Mon, 15 Mar 2021 15:09:09 GMT

Hello guys,

Iam trying resolve issue in my environment of firewalls. Question.

I have VTI interfaces with IKEV2.Via them is BGP. Tunnel work well BGP up, routes changed.But...

Packet-tracer input what ??? is possible to do if i want test traffic that incoming from VTI and goes to my inside ? I can add here VTI interface by default..Only outside..And it shows drop exactly..

Another thing..I have on every ASAs asa984-32-smp-k8.bin

but i have problem provide SSH from one network(from PC) to another ASA inside interface...It works only after reload of target ASA. I can reload ASA every time...Its crazy. Because in nwtwork is 30 firewalls but iam facing this only on 5 of them.....Somebody is facing something simillar ?

Re: ASA VTI source interface packet tracer

Sheraz.Salim — Mon, 15 Mar 2021 15:51:28 GMT

ASA with VTI wont allow you to do a packet tracer. only thing you can do it to setup a capture on VTI interface.

- what is the interface configuration and what is the command configured for your ssh?

Re: ASA VTI source interface packet tracer

prestigio391 — Mon, 15 Mar 2021 15:56:05 GMT

Hello,

Thanks for reply.

!
interface GigabitEthernet1/2.181
description --Users--
vlan 181
nameif inside
security-level 100
ip address 172.30.81.1 255.255.255.0 standby 172.30.81.2

ssh cfg:

ssh 10.200.10.0 255.255.255.0 inside

ssh version 2
ssh key-exchange group dh-group1-sha1

Re: ASA VTI source interface packet tracer

Sheraz.Salim — Mon, 15 Mar 2021 16:41:40 GMT

That’s strange behaviour is your layer2 solid?

Re: ASA VTI source interface packet tracer

prestigio391 — Mon, 15 Mar 2021 16:45:58 GMT

Its not about L2 i think... 🙂 Iam going from my pc from Location A to FW in location B.... Not working...But exactly same cfg in Location C..same conditions working..Only reload of FW help...After few week same thing...

Re: ASA VTI source interface packet tracer

prestigio391 — Fri, 26 Mar 2021 08:38:33 GMT

Hello,

I don know if its bug solution is...

no management-access {name of inside interface}

management-access {name of inside interface}

After this ssh working....Weird...

Thanks for answers

Re: ASA VTI source interface packet tracer

Sheraz.Salim — Fri, 26 Mar 2021 08:54:25 GMT

Glad it work out wired though.