Cisco asa help

markdacoron — Tue, 12 Mar 2019 05:55:30 GMT

I get this message on log

TCP access denied by ACL from 70.xxx.xxx.xxx/3061 to outside:xxx.xxx.xxx.178/443

I am not a cisco person.

Any help will be appreciated.

: Saved
:
ASA Version 8.0(4)
!
hostname ciscoasa
domain-name xxxxx.com
enable password XXXXX encrypted
passwd XXXX encrypted
names
name 10.1.11.25 Apple
!
interface Ethernet0/0
nameif outside
security-level 0
ip address xxx.xxx.xxx.178 255.255.255.252
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.1.11.2 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level

no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
regex domainlist1 "\.youtube\.com"
regex domainlist2 "\.facebook\.com"
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
name-server 10.1.3.32
name-server 10.1.3.33
domain-name xxxx.com
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp 10.1.11.0 255.255.255.0 any
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.7.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.4.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.8.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat extended permit ip 10.1.11.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list nonat extended permit ip 10.1.3.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.1.7.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.1.7.0 255.255.255.0 10.1.4.0 255.255.255.0
access-list nonat extended permit ip 10.1.2.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.8.0 255.255.255.0 10.1.8.0 255.255.255.0
access-list nonat extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0
access-list nonat extended permit ip 192.168.10.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list inside_mpc extended permit tcp any any eq www
access-list inside_mpc extended permit tcp any any eq 8080
access-list outside_access_in extended permit icmp any any inactive
pager lines 24
logging enable

logging buffered informational
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
failover timeout -1
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-712.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp xxx.xxx.xxx.178 https Apple https netmask 255.255.255.255
static (inside,inside) 192.168.10.0 192.168.10.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.11.0 10.1.11.0 netmask 255.255.255.0
static (inside,inside) 10.1.3.0 10.1.3.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.7.0 10.1.7.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.4.0 10.1.4.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.2.0 10.1.2.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.8.0 10.1.8.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.0.0.0 10.0.0.0 netmask 255.0.0.0 norandomseq nailed
static (inside,outside) xxx.xxx.xxx.178 Apple netmask 255.255.255.255 dns
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 67.52.149.177 1
route inside 10.0.0.0 255.0.0.0 10.1.11.1 1
route inside 10.1.2.0 255.255.255.0 10.1.11.1 1
route inside 10.1.3.0 255.255.255.0 10.1.11.1 1
route inside 10.1.4.0 255.255.255.0 10.1.11.1 1
route inside 10.1.7.0 255.255.255.0 10.1.11.1 1
route inside 10.1.8.0 255.255.255.0 10.1.11.1 1
route inside 192.168.10.0 255.255.255.0 10.1.11.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.1.11.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 management
ssh timeout 5
console timeout 0
dhcpd dns 10.1.3.32 10.1.3.33
dhcpd domain xxxxx.com
dhcpd auto_config inside
!
dhcpd dns 10.1.3.32 10.1.3.33 interface inside
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
class-map type regex match-any DomainBlockList
match regex domainlist1
match regex domainlist2
class-map type inspect http match-all BlockDomainsClass
match request header host regex class DomainBlockList
class-map inspection_default
match default-inspection-traffic
class-map type inspect http match-all AppHeaderClass
class-map httptraffic
match access-list inside_mpc
class-map type inspect http match-all BlockURLsClass
!
!
policy-map type inspect http http_inspection_policy_blockdomains
parameters
protocol-violation action drop-connection
class AppHeaderClass
drop-connection log
match request method connect
drop-connection log
class BlockDomainsClass
reset log
class BlockURLsClass
reset log
policy-map type inspect dns migrated_dns_map_1
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns migrated_dns_map_1
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect icmp
class httptraffic
inspect http http_inspection_policy_blockdomains
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:b489c2480654120d513d7cb907a92c82
: end

- See more at: https://supportforums.cisco.com/discussion/12505581/help-needed-cisco-asa-5505-website-https-access#sthash.y76HHrgt.dpuf

Your access-list outside

Pavel Trinos — Wed, 13 May 2015 12:36:03 GMT

Your access-list outside_access_in is missing a line to allow your access on HTTPS port to your Apple device.

Try this:

access-list outside_aceess_in extended permit tcp any xxx.xxx.xxx.178 255.255.255.255 eq 443

I tried that but still no

markdacoron — Wed, 13 May 2015 13:53:46 GMT

I tried that but still no luck.

Hi,With the above ACL in

Vibhor Amrodia — Thu, 14 May 2015 04:23:56 GMT

Hi,

With the above ACL in place , can you provide the output of this packet trace:-

packet input outside tcp 4.2.2.2 2345 xxx.xxx.xxx.178 443 det

Thanks and Regards,

Vibhor Amrodia

Phase: 1Type: FLOW

markdacoron — Thu, 14 May 2015 16:36:54 GMT

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in xxx.xxx.xxx.178 255.255.255.255 identity

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd56a0d20, priority=0, domain=permit, deny=true
        hits=5517604, user_data=0x9, cs_id=0x0, flags=0x1000, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Looks like this line of code

markdacoron — Fri, 15 May 2015 14:15:36 GMT

Looks like this line of code fixed the issue.