topic Re: CISCO ASA in Network Security

CISCO ASA

fmugambi — Thu, 20 Jun 2024 06:08:04 GMT

Hello Team,

I have a cisco asa firewall connected to ISP. I have allowed internet access of downstream devices on the asa.

I have a case where, servers downstream are able to browse internet, but not able to ping for example 8.8.8.8.

is there an acl restriction anywhere? is there an extra command i need for ping replies to be successful. this is useful for troubleshooting.

Thank you.

Re: CISCO ASA

Rob Ingram — Thu, 20 Jun 2024 06:26:40 GMT

@fmugambi you can enable ICMP inspection to allow ping responses, use the CLI command fixup protocol icmp

This will amend the class map as below

class inspection_default
 inspect icmp

Re: CISCO ASA

balaji.bandi — Thu, 20 Jun 2024 07:03:38 GMT

My always first step command

config t

fixup protocol icmp

end

Re: CISCO ASA

fmugambi — Thu, 20 Jun 2024 11:21:31 GMT

on that note, is there a specific cli command to just check acls with hit counts only?

Re: CISCO ASA

Rob Ingram — Thu, 20 Jun 2024 11:35:43 GMT

@fmugambi

ASA# show access-list | exclude hitcnt=0

Re: CISCO ASA

fmugambi — Thu, 20 Jun 2024 11:50:11 GMT

if i have multiple, say dm_access_in, outside_access_in, inside_access_out, how do i filter to specifics?

Re: CISCO ASA

Rob Ingram — Thu, 20 Jun 2024 12:01:37 GMT

@fmugambi you just add the name of the ACL, i.e.,

show access-list dm_access_in | exclude hitcnt=0
show access-list outside_access_in | exclude hitcnt=0
show access-list inside_access_out | exclude hitcnt=0

Re: CISCO ASA

fmugambi — Thu, 20 Jun 2024 12:10:06 GMT

thanks, helpful.

what if say in dm_inside_access_out, i have multiple vlans, 172.16.10.0/24,.20/24,.30.24.

is it possible to drill to specific vlan and get hitcount per vlan based?

Re: CISCO ASA

MHM Cisco World — Thu, 20 Jun 2024 14:03:00 GMT

the ASA ACL is apply to L3 interface which have nameif and VLAN,
show run | in <nameif>
then you will see

access-group with nameif
last
do
show access-list <name of access-group appear> | include hitcnt

this way you can see access list hitcnt for each vlan

MHM