TCP/UDP 5060 traffic not happening between same security interfaces on Cisco ASA.

srijivdimri1 — Fri, 21 Feb 2020 16:23:26 GMT

Hi Everyone, I am facing some weird issue where ping traffic works fine , however tcp/udp 5060 traffic fails.

There are 2 interfaces configured as below -

ASA/pri/act(config)# sh run int Ethernet0/2.1097

interface Ethernet0/2.1097

vlan 1097

nameif inside_host

security-level 100

ip address 10.30.197.1 255.255.255.0

ASA/pri/act(config)# sh run int Ethernet0/3.3897

interface Ethernet0/3.3897

vlan 3897

nameif fin_host

security-level 100

ip address 10.30.254.54 255.255.255.248

'same-security-traffic permit inter-interface' and 'same-security-traffic permit intra-interface' is in place.

Inspection for SIP and ICMP is Enabled.

When I do a capture, I see the packet being forwarded to the next module for processessing -

packet-tracer input inside_host tcp 10.30.197.10 5060 32.253.42.122 5060 detail

Phase: 1

Type: CAPTURE

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xad646b18, priority=13, domain=capture, deny=false

hits=85287, user_data=0xad90f710, cs_id=0x0, l3_type=0x0

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0000.0000.0000

input_ifc=inside_host, output_ifc=any

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xabe958e8, priority=1, domain=permit, deny=false

hits=181625, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

input_ifc=inside_host, output_ifc=any

Phase: 3

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 32.253.42.122 255.255.255.255 fin_host

Phase: 4

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xac2a9378, priority=2, domain=permit, deny=false

hits=288, user_data=0x0, cs_id=0x0, flags=0x3000, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside_host, output_ifc=any

Phase: 5

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xabe4ac38, priority=0, domain=inspect-ip-options, deny=true

hits=396, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside_host, output_ifc=any

Phase: 6

Type: FOVER

Subtype: standby-update

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xabe94528, priority=20, domain=lu, deny=false

hits=7, user_data=0x0, cs_id=0x0, flags=0x0, protocol=6

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside_host, output_ifc=any

Phase: 7

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Reverse Flow based lookup yields rule:

in id=0xac17edd0, priority=0, domain=inspect-ip-options, deny=true

hits=8, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=fin_host, output_ifc=any

Phase: 8

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 2959779, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Result:

input-interface: inside_host

input-status: up

input-line-status: up

output-interface: fin_host

output-status: up

output-line-status: up

Action: allow

However, when I apply capture on the inside_host and fin_host interfaces, I see request and reply reaching the host behind inside_host interface, and just the request coming on the fin_host interface -

capture capin type raw-data access-list test interface fin_host

capture capout type raw-data access-list test interface inside_host

sh cap capin

13 packets captured

1: 05:40:46.800800 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

2: 05:40:47.300979 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

3: 05:40:48.301208 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

4: 05:40:50.300445 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

5: 05:40:54.301177 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

6: 05:40:58.301116 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

7: 05:41:02.302291 802.1Q vlan#3897 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

sh cap capout

30 packets captured

1: 05:40:47.300994 802.1Q vlan#1097 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

2: 05:40:47.301437 802.1Q vlan#1097 P0 10.30.197.10.5060 > 32.253.42.122.5060: udp 489

3: 05:40:48.301223 802.1Q vlan#1097 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

4: 05:40:48.301681 802.1Q vlan#1097 P0 10.30.197.10.5060 > 32.253.42.122.5060: udp 489

5: 05:40:50.300475 802.1Q vlan#1097 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

6: 05:40:50.300918 802.1Q vlan#1097 P0 10.30.197.10.5060 > 32.253.42.122.5060: udp 489

7: 05:40:54.301192 802.1Q vlan#1097 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

8: 05:40:54.301635 802.1Q vlan#1097 P0 10.30.197.10.5060 > 32.253.42.122.5060: udp 489

9: 05:40:56.402414 802.1Q vlan#1097 P0 10.30.197.10.5060 > 32.253.42.122.5060: udp 439

10: 05:40:58.301162 802.1Q vlan#1097 P0 32.253.42.122.61442 > 10.30.197.10.5060: udp 405

There is NO ACL of any sort configured on these 2 interfaces, but I still do not see the reply packets from inside_host interface reaching fin_host interface.

Please suggest what exactly am I missing here.

Thanks for all your help in advance.

topic TCP/UDP 5060 traffic not happening between same security interfaces on Cisco ASA. in Network Security

TCP/UDP 5060 traffic not happening between same security interfaces on Cisco ASA.