topic Re: ASA dropping outbound Multicast packets in Network Security

ASA dropping outbound Multicast packets

james.tribble — Tue, 22 Feb 2022 18:51:03 GMT

I have a system inside my network that we use to test Multicast sessions between my network and other sites. When I start it I can see incoming connections but nothing sending. I looked in the log and found the following errors on the ASA5525x version 9.14.3.

%ASA-7-710005: UDP request discarded from x.x.x.x/1193 to outside:225.3.10.33/1234

All outbound multicast packets are being dropped. When I did a sh asp drop it shows no-mcast-intrf

I have a static entry for the rp and we are using pim sparse. This has worked in the past.

I am on version 9.14.3.

Re: ASA dropping outbound Multicast packets

MHM Cisco World — Tue, 22 Feb 2022 19:36:45 GMT

https://quickview.cloudapps.cisco.com/quickview/bug/CSCvd82323

Re: ASA dropping outbound Multicast packets

james.tribble — Tue, 22 Feb 2022 20:09:48 GMT

I found that article and I was running embryonic timeout. I changed the data flow that was using it and no difference. I then turned it off and I am still having the same issue.

Re: ASA dropping outbound Multicast packets

MHM Cisco World — Tue, 22 Feb 2022 20:18:15 GMT

you change the embryonic timeout did you clear the traffic flow

clear conn protocol udp .......

try this then check the result.

Re: ASA dropping outbound Multicast packets

james.tribble — Wed, 23 Feb 2022 16:22:50 GMT

That still did not work. Still getting the dropped packet message,

Re: ASA dropping outbound Multicast packets

MHM Cisco World — Thu, 24 Feb 2022 14:04:44 GMT

The ASA Drops Multicast Packets Due to Security Policy Of Outbound Access-list

With this specific issue the ASA is correctly dropping multicast packets (per the configured security policy). However, it is difficult for the network administrator to identify the reason for the packet drops. In this case, the ASA is dropping packets due to the outbound access-list configured for an interface. The workaround is to permit the multicast stream in the outbound access-list.

When this occurs, multicast packets will be dropped and the ASP drop counter will be "FP no mcast output intrf (no-mcast-intrf)".

Outbound ACL apply config it to allow the multicast.

Re: ASA dropping outbound Multicast packets

james.tribble — Mon, 28 Feb 2022 14:14:07 GMT

I have access-list specifically for this traffic and I see traffic hits on the ACL's, However in a test I put in a permit ip any any on both the inside and outside interfaces in both direction and this did not even help.