topic Pack Trace output in Network Security

Pack Trace output

opnineopnine — Tue, 12 Mar 2019 05:04:54 GMT

Please check my pack trace outpu, when you get a Phase 3 issue, how can I keep doing the troubleshooting.?

thansk.

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

You need to allow the traffic

Karsten Iwen — Fri, 14 Nov 2014 15:02:05 GMT

You need to allow the traffic in the ACL thats assigned to the interface where the traffic is entering the ASA. The "Implicit Rule" is always used when no other rule matches.

KarstenLook this output,

opnineopnine — Mon, 17 Nov 2014 21:21:29 GMT

Karsten

Look this output, where should I create the acls? Thanks.

Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 142.100.64.0 255.255.255.0 inside

Phase: 4
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 172.18.3.23 255.255.255.255 outside

Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop

Always the interface where

Karsten Iwen — Mon, 17 Nov 2014 21:43:20 GMT

Always the interface where the initial traffic enters the ASA. Seems to be the outside interface in your case.