topic Hi R.seth, Finally the sc in Network Security

Access denied

networksolution.mann — Tue, 12 Mar 2019 06:40:04 GMT

Dear Cisco,

Taking assistance from you end is always helpfull.

So here i am one more issue to discuss where i required solutions on immediate basis.

I am getting this error while using internal computers via asa firewall from 192.168.X.X ip addres.

Please check for the error with attachment.

Hi, Do you see this message

Rishabh Seth — Wed, 30 Sep 2015 07:40:45 GMT

Hi,

Do you see this message when you try to filter traffic through CX ? If yes then can you try bypassing

CX to check if you still see the issue.

In case the bypass of CX helps then i would say you should check CX logs to find the reason for drop and

then tweak your CX policies accordingly.

Thanks,

R.Seth

Hi r seth,This was the first

networksolution.mann — Wed, 30 Sep 2015 09:42:10 GMT

Hi r seth,

This was the first thing came into my mind thats why i put all the features of asa cx into monitor mode only and start asa aslo throughbasic setting via monitor only mode in policy map.

Hi, You can try creating a

Rishabh Seth — Wed, 30 Sep 2015 09:54:18 GMT

Hi,

You can try creating a deny ACL entry for a test machine and use it in the redirection policy map.

Also check if there is any other device in your network that might be blocking your traffic.

Thanks,

R.Seth

Hi r.seth,according to

networksolution.mann — Wed, 30 Sep 2015 11:22:40 GMT

Hi r.seth,

according to network right now, there is no deny acl working in asa and asa cx is already in monitor only mode as well as there is no other device which can be used to block or deny traffic like this.there is some issue with asa so kindly provide me the required solution here.

Hi,I do not have ready

Rishabh Seth — Wed, 30 Sep 2015 11:40:14 GMT

Hi,

I do not have ready solution as we are not sure what exactly is causing it, but you can try to find cause for the issue.

I would say you can try bypassing CX by creating an ACL entry to deny traffic from redirection for a particular host. If you still see the problem then I would say you should try capturing the traffic to see if ASA is forwarding traffic or not. These tests would help you narrow down the problem.

In case the issue gets resolved after bypassing CX then you should check CX config.

If you face any difficulty in troubleshooting you should contact TAC and discuss this issue.

Hope this answers your query!!!

Thanks,

R.Seth

This is not quite helpful but

networksolution.mann — Wed, 30 Sep 2015 12:32:13 GMT

This is not quite helpful but could you tell me how i can use Asdm on 192.168.0.X/24 network where management cable is configured on 192.168.1.1/24.so i want to use asdm on my desktop from 192.168.0.118/24 but its configured at 192.168.1.1/24

If you are able to reach the

Rishabh Seth — Wed, 30 Sep 2015 12:54:22 GMT

If you are able to reach the management IP from your workstation then you can enable ASDM access on the Management interface and then access it to manage device.

commands to enable ASDM:

>> asdm image disk0:/<image-name>

>> http server enable

>> http <ip> <mask> interface name.

Ensure you have ASDM image present on the ASA.

Thanks,

R.Seth

HI r.seth, This is quite help

networksolution.mann — Fri, 02 Oct 2015 09:03:26 GMT

HI r.seth,

This is quite help full but we are still facing the issue for access denied.should i share running or startup configration for asa with you ?

Hi, I would suggest you to

Rishabh Seth — Fri, 02 Oct 2015 09:27:28 GMT

Hi,

I would suggest you to completely bypass CX.

Then apply capture from a particular host machine for a particular website.

This would let you narrow down the issue:

>> If bypassing CX by using deny ACL in redirection policy helps then you can continue troubleshooting CX.

>> If the capture on ASA shows that the traffic is allowed by the ASA then you can try checking other aspects of the network for issue.

>> Also did you try accessing Website from a different machine and a different web-browser.

>> I would suggest you to open a case with TAC to get speedy resolution.

Let us know your findings.

Thanks,

R.Seth.

HI r.seth,I am still working

networksolution.mann — Thu, 08 Oct 2015 13:03:51 GMT

HI r.seth,

I am still working on that issue and its still there. I am not getting the way out to resolve the issue.

this time am sending you the attachment for running configuration.please let me know if there is any possibility.

Hi r.seth, i am still

networksolution.mann — Wed, 14 Oct 2015 05:33:18 GMT

Hi r.seth,

i am still waiting for ur reply .please provide me some other refrence guys who can help me with that....

Hi,If you are seeing issue

Rishabh Seth — Wed, 14 Oct 2015 06:10:57 GMT

Hi,

If you are seeing issue even after permitting the traffic and bypassing the CX then you should reach out to TAC and discuss the issue.

I don't see anything in the config that would block the traffic. You can check the sessions on ASA for host from where you try accessing the website.

Also check if you have any other firewall that might be blocking the traffic.

Thanks,

R.Seth

No R.seth there is no extra

networksolution.mann — Wed, 14 Oct 2015 06:34:42 GMT

No R.seth there is no extra firewall is working in the network.kindly provide an relevant answer which can help us.

Or please provide some other references.

Your config permits all the

Rishabh Seth — Wed, 14 Oct 2015 07:08:15 GMT

Your config permits all the traffic and still you are seeing this issue.

Do you see this issue for all the web traffic or there is one specific website which is failing to open.

If it is one particular website then you should try accessing it through a different internet connection (basically try bypassing ASA). Issue might be outside firewall.

Share your findings.

Thanks,

R.Seth

So you mean to say that i

networksolution.mann — Wed, 14 Oct 2015 07:16:00 GMT

So you mean to say that i should try bypass my asa firewall ?

coz this issue is only for standard charted bank site from any url like sc.com,ibank.standardchrted.com as well as my phone for standard charted is also not working.

If an alternate internet

Rishabh Seth — Wed, 14 Oct 2015 07:22:06 GMT

If an alternate internet connection (your phone) is not helping in opening the same website, then it might be an issue with the website.

Try to bypassing firewall/ use different internet connection to isolate issue. This way you will be sure if you need to troubleshoot ASA or look into your ISP side for troubleshooting.

Thanks,

R.Seth

Hi R.seth, Finally the sc

networksolution.mann — Fri, 16 Oct 2015 10:19:49 GMT

Hi R.seth,

Finally the sc.com is again working good i'd like to thanx to you its very much helpfull the way you assist me to resolve this issue.

R.seth, I came up with one

networksolution.mann — Fri, 16 Oct 2015 10:22:49 GMT

R.seth,

I came up with one suggestion from you.

That we are suppose to connect a NAS in our network so kindly help me to suggest that what should we buy and what architecture we should follow, which can help us connecting both floors as well consider asa firewall to in that network.

Hi, Glad the the issue is

Rishabh Seth — Fri, 16 Oct 2015 10:32:57 GMT

Hi,

Glad the the issue is resolved, so was the issue external to the ASA and how did you resolve it.

I do not have much information about NAS, but yes you can refer following link:

http://www.cisco.com/c/en/us/products/collateral/storage-networking/fs-5500-series-integrated-nas/product_data_sheet0900aecd80332b82.html

Thanks,

R.Seth