topic Tracing Connection in Multi context ASA in Network Security

Tracing Connection in Multi context ASA

mahesh18 — Tue, 12 Mar 2019 01:49:00 GMT

Hi Everyone,

Trying to trace the path going via the ASA in Multi context Active active Mode.

Need to check the port connection between 2 servers

Server A is connected to switch 1

Server B is connected to Switch 3

Here is topology

Sw1 Sw2 ASA Sw3

ASA has two context 1 and 2 and 1 is admin.

Context 1 has few interfaces.

Interface X of Context 1 has Server A subnet there

Interface Y of context has Server B subnet there.

In other words traffic going from server A to server B goes via interface x and interface y of ASA.

Or we can say that interface x of ASA has connection to Sw2 and interface y has connection to Sw3.

i try to run the packet tracer through the ASDM and CL it failed.

I verify that ASA which i log on is Active for group 1 and context 1 is member of group 1

I used source interface as X is this right interface to choose?

Thanks

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Sat, 25 May 2013 06:23:53 GMT

Hello Mahesh,

We are missing a little info

Interface Y of context has Server B subnet there.

You did not specify the context, is it on the same context(I mean context 1 as well)

If that is the case then is just a regular connection across a firewall like it were on single mode,

Make sure you have the right Policies,NAT,ACL in place and u should be good,

Let us know if it's a different context

Regards

Remember to rate all of the helpful posts

Tracing Connection in Multi context ASA

mahesh18 — Sat, 25 May 2013 15:54:41 GMT

Hi Julio.

The interface Y is also in context 1

When i ran the packet tracer from CLI using source interface as X it do not work

There is ACL that allows the traffic from Source to destination.

But packet tracer does not work

I tested with existing ACL that allows traffic from source to destination server still packet tracer does not work

gives error Virtual firewall classification failed

Thanks

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Sat, 25 May 2013 21:24:23 GMT

Hello Mahesh,

Can you share the interface allocation configuration, the show run of that context and the exact packet tracer config and output?

Regards

Tracing Connection in Multi context ASA

mahesh18 — Sat, 25 May 2013 22:40:30 GMT

Hi Julio,

As packet tracer is even not working for ACL which is configured on the ASA and traffic for that is allowed that shows

some odd behaviour of packet tracer when ASA is configured with Multi context mode.

I fine some these urls about packet tracer in multi context mode.

https://supportforums.cisco.com/thread/2117679

http://www.mail-archive.com/ccie_security@onlinestudylist.com/msg02474.html //www.mail-archive.com/ccie_security@onlinestudylist.com/msg02474.html

Thanks

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Sun, 26 May 2013 19:40:04 GMT

Hello Mahesh,

Okey, I did not pay attention to the following

"I tested with existing ACL that allows traffic from source to destination server still packet tracer does not work

gives error Virtual firewall classification failed"

Is any of the interfaces in place being shared between multiple contexts ?

On the NAT statements you have, is there any being used with the keyword "any"

what is the exact version you are running?

Regards

Tracing Connection in Multi context ASA

mahesh18 — Sun, 26 May 2013 22:12:14 GMT

Hi Julio,

interfaces 0/3 is shared but interfaces x and y are not shared.

IOS is 8.05(28)

Interface X has

nat(X) 0 0.0.0.0.0 0.0.0.0.

Thanks

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Sun, 26 May 2013 22:19:05 GMT

Hello,

Okey but X and Y are not logical interfaces derived from ether 0/3 right?

Is there a way you can share the configuration and packet tracer you are doing

Tracing Connection in Multi context ASA

mahesh18 — Tue, 28 May 2013 02:31:19 GMT

Hi Julio,

After doing some more digging i fig out that Both source and destination are under same interface of ASA which is Y.

Interface X is not involved.

Here is update info

Sw3 has SVI VLAN for both the Servers.

Server A which is connected to Switch 1 has SVI VLAN in SW3.

Server B which is connected to Switch 3 has SVI VLAN in SW3.

Both the SVI vlans in SW3 have different subnets.

Need to understand the traffic flow from server A to server B

Traffic from switch 1 goes all the way to SW 3 SVI VLAN say 1 passing via ASA.

Then to reach the destination server B does it touch the ASA or not?

As per my understanding it should not touch the ASA as SW3 is layer 3 switch and both the source and destination subnets are connected to sw3?

Need to confirm with you?

Regards

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Tue, 28 May 2013 02:54:56 GMT

Traffic from switch 1 goes all the way to SW 3 SVI VLAN say 1 passing via ASA.

Then to reach the destination server B does it touch the ASA or not?

It does not , traffic will reach the switch and it will get routed to the proper SVI, traffic will never reach the ASA.

As per my understanding it should not touch the ASA as SW3 is layer 3 switch and both the source and destination subnets are connected to sw3?

That is correct, it will not flow to the ASA,

Regards,

Remember to rate all of the helpful posts

Julio Carvajal

Tracing Connection in Multi context ASA

mahesh18 — Tue, 28 May 2013 03:02:14 GMT

Hi Julio,

Many thanks again.

Its always good to have your confirmation.

Regards

Mahesh

Tracing Connection in Multi context ASA

Julio Carvajal — Tue, 28 May 2013 03:36:10 GMT

Hello Mahesh,

My pleasure to help,

Regards