topic Re: CIsco ASA in Network Security

CIsco ASA

Poo17 — Tue, 25 May 2021 15:41:16 GMT

Hello,

site to site tunnel is up on the firewall but the packet encap is showing 0. It looks like ASA is not sending any encrypted packet to the tunnel. Any suggestion?

Re: CIsco ASA

Rob Ingram — Tue, 25 May 2021 15:52:41 GMT

@Poo17

It could potentially be the traffic is unintentially natted by an existing nat rule. Or a routing issue from the local switch.

Run packet-tracer from the CLI and provide the output.

Also provide your configuration and the output of "show nat detail".

Re: CIsco ASA

balaji.bandi — Tue, 25 May 2021 16:39:32 GMT

Not sure what is the issue, can you show us exmaple config, if the traffic need to go to destination you need to be added in intresting traffic to allow in tunnel. this can be verified your config and ACL.

Re: CIsco ASA

Poo17 — Thu, 27 May 2021 02:53:29 GMT

How to run the packet tracer command?

Re: CIsco ASA

Marvin Rhoads — Thu, 27 May 2021 04:41:47 GMT

Like this:

packet-tracer input <interface name of your inside interface> tcp <source address of any inside host> 1025 <destination address of any remote host> 80

It doesn't matter if the destination host is listening on port 80 or not. Packet-tracer only creates a synthetic packet for processing into the ASA and displays the results of the packet processing.

Re: CIsco ASA

Poo17 — Thu, 27 May 2021 06:07:36 GMT

Thank you, Marvin. This is what I got

ASA# packet-tracer input inside tcp 1.1.1.1 1025 2.2.2.2 80

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 via 12.X.X.X, outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Re: CIsco ASA

Marvin Rhoads — Thu, 27 May 2021 06:45:57 GMT

Did you use a real inside and outside host address vs. the dummy "1.1.1.1" and "2.2.2.2" you indicated in your reply?

If so, then you appear to have an access-list on the inside interface denying the incoming traffic.

Re: CIsco ASA

Poo17 — Thu, 27 May 2021 06:53:24 GMT

Yes, I used the real IP address.

Re: CIsco ASA

Marvin Rhoads — Thu, 27 May 2021 10:06:58 GMT

So check your ACL (any ACL applied to the interface with "access-group" command in the running-config or appearing in ASDM under the inside interface).

Re: CIsco ASA

Poo17 — Thu, 27 May 2021 17:11:52 GMT

ASA# sh run | i access-group
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside

Re: CIsco ASA

Marvin Rhoads — Thu, 27 May 2021 20:57:31 GMT

Need to check the access-list inside_access_in.