topic Which Debug in Network Security

Which Debug

GRANT3779 — Tue, 12 Mar 2019 01:57:21 GMT

Hi All,

I'd like to see if an ASA is blocking / dropping traffic whenI try to connect to a server. I'm basically getting timeout errors every so often, and want to see if it's the ASA which is in the path of the traffic.

What's the best Debug command to run to see IP traffic in general and check if the ASA is causing issues? Can I filter the debug via IP so I can narrow it down to whatever my source IP is? New to the ASA and want to narrow my debug down as much as I can.

Thanks

Which Debug

Jouni Forss — Thu, 13 Jun 2013 10:16:41 GMT

Hi,

The easiest way to test this is when you know the source and destination IP address and ports used by the connection

Then you can use the "packet-tracer" command on the ASA

packet-tracer input

The is the "nameif" of the interface behind which the connecting host is located at

- Jouni

Which Debug

GRANT3779 — Thu, 13 Jun 2013 11:10:26 GMT

Hi,

Thanks for that. WHen using this command, can I leave out certain parts, e.g Source port? As this would be randomly generate I'd imagine. Can I just use Source IP with the packet tracer command?

Which Debug

Jouni Forss — Thu, 13 Jun 2013 11:45:52 GMT

Hi,

You need to enter the information mentioned above.

You can insert any random source port you want so its not really an issue with using this command.

- Jouni

Which Debug

GRANT3779 — Thu, 13 Jun 2013 11:51:52 GMT

The command isn't available from CLI or ASDM.. It's running in transparent mode but i'm sure there are default settings causing an issue somewhere.

It's a 551X.

Which Debug

Jouni Forss — Thu, 13 Jun 2013 11:56:34 GMT

Hi,

Yes, the command is not available when the ASA is in Transparent mode.

If I am not mistaken (dont use Transparent firewalls really) you still should be able to do a packet capture on the ASA.

Have you monitored the ASA logs while connecting to the remote site?

Are you facing problems connecting to some local server behind the ASA or is the server on the Internet?

- Jouni