topic Re: Packet Tracer (Implicit Deny) issue in Network Security

Packet Tracer (Implicit Deny) issue

Kemal Zuko — Tue, 12 Mar 2019 03:22:16 GMT

Hello,

I am trying to do a simple packet tracer on my ASA and this is what I am getting

ASA# packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.0.6 22 xml

<Phase>
<id>1</id>
<type>ROUTE-LOOKUP</type>
<subtype>input</subtype>
<result>ALLOW</result>
<config>
</config>
<extra>
in 10.250.0.4 255.255.255.252 DMZ
</extra>
</Phase>

<Phase>
<id>2</id>
<type>ACCESS-LIST</type>
<subtype></subtype>
<result>DROP</result>
<config>
Implicit Rule
</config>
<extra>
</extra>
</Phase>

<result>
<input-interface>DMZ</input-interface>
<input-status>up</input-status>
<input-line-status>up</input-line-status>
<output-interface>DMZ</output-interface>
<output-status>up</output-status>
<output-line-status>up</output-line-status>
<action>drop</action>
<drop-reason>(acl-drop) Flow is denied by configured rule</drop-reason>
</result>
ASA#

The 10.250.0.6 deve is a router directly connected to the DMZ interface 10.250.0.5

However I am getting the reason for droped packet as (Implicit Rule) which I can see is only on the global interface.

I am permiting ip any any on that same interface as well.

How can I make this work?

The reson for this is I need my ASA to authenticate with TACACS server which is behind the 10.250.0.6 router

Packet Tracer (Implicit Deny) issue

Mariusz Bochen — Fri, 27 Dec 2013 10:54:52 GMT

Hi Kemal,

Reading your post 2 things came in to my mind:

1. Why you use /30 mask on your firewall? With this mask you have only 2 useable addresses. One you're going to use for the firewall interface IP, second one for the router.

2. Packet tracer with specified same source and destination network will always fail even if you allow all the traffic and enable same security traffic. Devices communicating within the same subnet will not hit the firewall.

Unless this is just a typo and you should just change the destination IP in the packet tracer? What is your TACACS IP ?

Regards

Mariusz

Packet Tracer (Implicit Deny) issue

Kemal Zuko — Fri, 27 Dec 2013 14:01:11 GMT

the reason I have a /30 between my ASA and my router is tat behind my router I have another IP scope for my LAN (10.250.100.128/25)

I am douing dynamic pat on the asa and the router for the workstations to get out

the ip address of the tacacs server is 10.250.100.142 I am getting the same packet tracer resoult with the other IP as well

Packet Tracer (Implicit Deny) issue

Mariusz Bochen — Fri, 27 Dec 2013 15:35:42 GMT

Would you be able to post the config fot us?

Packet Tracer (Implicit Deny) issue

Kemal Zuko — Tue, 31 Dec 2013 04:04:52 GMT

Hello

yes the config is below...

The tow router behing DMZ and INSIDE interfaces on the ASA are able to authenticate against the tacaacs server

ASA Version 9.1(2)

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/0

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142 >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http

https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email

callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end

ASA Version 9.1(2)

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/0

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142 >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email

callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end

any suggestions?

Thanks

Packet Tracer (Implicit Deny) issue

Mariusz Bochen — Tue, 31 Dec 2013 11:38:49 GMT

Hi Kemal,

Sorry, but I have few more questions

Can you see the 10.250.100.128/25 network in the routing table (learned by eigrp)?

Are you able to ping the 10.250.100.142 from the ASA's DMZ interface?

Can you please post the result of

packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.100.142 22 ?

Regards

Mariusz

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Tue, 31 Dec 2013 13:20:30 GMT

Hello Mariusz,

I can see the 10.250.100.128/25 network in my routing table via EIGRP

here are the resoults you have asked for

ASA# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 12:01:54, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 12:01:54, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    75.11.11.0 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 75.11.11.1, outside
ASA#

ASA# ping 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

ASA# ping DMZ 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASA#
ASA#

ASA# traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

1   * * *
2   * * *
3   * *

ASA#

ASA# packet-tracer input dmZ tcp 10.250.0.5 2234 10.250.100.142 22

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.250.100.128 255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

ASA#

When I go to my ASDM and Under MOnitoring/Properties/AAA Servers I see the Tacacs Server configured but under status it says Failed.

here are some of the statistics of that screen

BiHTac

TACACS+

10.250.100.142

Failed

Server port: 49

Number of pending requests 0

Average round trip time 0ms

Number of authentication requests 12

Number of authorization requests 19

Number of accounting requests 0

Number of retransmissions 0

Number of accepts 0

Number of rejects 0

Number of challenges 0

Number of malformed responses 0

Number of bad authenticators 0

Number of timeouts 31

Number of unrecognized responses 0

Also it would be worth mentioning that I can ping 10.250.0.5 (DMZ interface) of the ASA from the Tacacs Server

C:\Users\aaa>ping 10.250.0.5

Pinging 10.250.0.5 with 32 bytes of data:
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254

Ping statistics for 10.250.0.5:
Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
Minimum = 1ms, Maximum = 1ms, Average = 1ms

C:\Users\aaa>tracert 10.250.0.5

Tracing route to 10.250.0.5 over a maximum of 30 hops

1 1 ms 1 ms 1 ms 10.250.100.129
2 1 ms 1 ms 1 ms 10.250.0.5

Trace complete.

Thanks

Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 03:30:00 GMT

We can see that an ACL is dropping the traffic. Can you do another packet-tracer with detail?

packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 04:20:17 GMT

Sure.. It looks like that it gets dropped by the Implicit Deny rule under Global

ASA# packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x5774bbf0, priority=1, domain=permit, deny=false
        hits=39042567, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=DMZ, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.250.100.128 255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x5775fdc0, priority=500, domain=permit, deny=true
        hits=1, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=10.250.0.5, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 04:37:06 GMT

What are you seeing in the logs on your TACACS server? Do you see authentication attempts fromthe ASA?

Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 14:33:51 GMT

No I dont see any requests from the 10.250.0.5 (DMZ) to the TACACS Server

here are the only two logs I see on my Tacacs

<94> 2014-01-01 08:11:58 [10.250.100.129:36682] New client connection opened for 10.250.100.15:13334 TID:11

<94> 2014-01-01 08:18:46 [10.250.100.15:13334] New client connection opened for 10.250.100.15:59242 TID:12

The 10.250.100.15 router is behind the 10.250.0.1 (inside interface)

Here is a packet tracer for that interface

ASA# packet-tracer input inside udp 10.250.100.15 2234 10.250.100.142 49 de$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.250.100.128 255.255.255.128 DMZ

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any4 any4
Additional Information:
Forward Flow based lookup yields rule:
in id=0x5828c890, priority=13, domain=permit, deny=false
        hits=27554, user_data=0x53100dc0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13320, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x57717078, priority=0, domain=inspect-ip-options, deny=true
        hits=28028, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13322, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x57751878, priority=0, domain=inspect-ip-options, deny=true
        hits=18130, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 56599, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: allow

And here is the traceroute from 10.250.100.15 to 10.250.100.142

WLAN_AP>traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

1 10.250.100.1 0 msec 0 msec 0 msec
2 10.250.0.6 0 msec 0 msec 0 msec
3 10.250.100.142 8 msec 0 msec 0 msec

I am puzzeld on how the above device can talk to the Tacacs Server but my ASA DMZ interface cant even Ping it.

Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 14:44:12 GMT

Can you try this-

Remove-

aaa-server BiHTac (DMZ) host 10.250.100.142

Add-

aaa-server BiHTac (inside) host 10.250.100.142

key ********

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 15:07:11 GMT

Negative

I now cant even log in using my local database

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (inside) host 10.250.100.142

key *****

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 inside

http 10.250.0.2 255.255.255.255 inside

ssh 10.250.100.140 255.255.255.255 inside

ssh 10.250.0.2 255.255.255.255 inside

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

Re: Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 15:12:02 GMT

When it was set to (DMZ) you were also using local creds to get in correct?

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 15:13:42 GMT

correct,

now I cant get in via ssh or http on inside interface

The only access I have is via console

I removed the ssh and http configuration for DMZ

Re: Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 15:28:10 GMT

Go ahead and change it back to (DMZ). Can you enable debug for TACACS and post some of the debug?

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 15:31:19 GMT

you mean to enable tacacs debug on the ASA?

Re: Packet Tracer (Implicit Deny) issue

Collin Clark — Wed, 01 Jan 2014 15:32:15 GMT

Yes, sorry.

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 15:45:02 GMT

here is what I see

%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authentication request for user kzuko : Auth-server group BiHTac unreachable

%ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = kzuko

%ASA-6-611102: User authentication failed: Uname: kzuko

%ASA-6-315011: SSH session from 10.250.0.6 on interface DMZ for user "kzuko" disconnected by SSH server, reason: "Internal error" (0x00)

%ASA-6-302014: Teardown TCP connection 61690 for DMZ:10.250.0.6/54569 to identity:10.250.0.5/22 duration 0:00:07 bytes 1347 TCP FINs

Re: Packet Tracer (Implicit Deny) issue

Kemal Zuko — Wed, 01 Jan 2014 15:48:03 GMT

Sorry Wrong log

here is the debug

%ASA-6-302013: Built outbound TCP connection 61851 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/31091 (10.250.0.1/31091)
%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/31091 to inside:10.250.100.142/49
mk_pkt - type: 0x2, session_id: 315
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging cmd-arg=console Tacacs packet sent
%ASA-6-302014: Teardown TCP connection 61851 for inside:10.250.100.142/49 to identity:10.250.0.1/31091 duration 0:00:00 bytes 0 No valid adjacency
Sending TACACS Authorization message. Session id: 315, seq no:1
%ASA-6-302013: Built outbound TCP connection 61852 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/52801 (10.250.0.1/52801)
TACACS Request timed out
TACACS Session finished. Session id: 315, seq no: 1

mk_pkt - type: 0x2, session_id: 316
mkpkt - authorize user: bihadmin
cmd=no
%ASA-6-302014: Teardown TCP connection 61852 for inside:10.250.100.142/49 to identity:10.250.0.1/52801 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=logging cmd-arg=console Tacacs packet sent
Sending TACACS Authorization message. Session id: 316, seq no:1
%ASA-6-302013: Built outbound TCP connection 61853 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/28448 (10.250.0.1/28448)
TACACS Request timed out
TACACS Session finished. Session id: 316, seq no: 1

mk_pkt - type: 0x2, session_id: 317
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging %ASA-6-302014: Teardown TCP connection 61853 for inside:10.250.100.142/49 to identity:10.250.0.1/28448 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=console Tacacs packet sent
Sending TACACS Authorization message. Session id: 317, seq no:1
%ASA-2-113022: AAA Marking TACACS+ server 10.250.100.142 in aaa-server group BiHTac as FAILED
BIHASA(config)# TACACS Request timed out
TACACS Session finished. Session id: 317, seq no: 1