topic ASA implicit drop in Network Security

ASA implicit drop

adamcarteratcisco — Tue, 12 Mar 2019 00:33:11 GMT

I need to be able to ssh to local interface on an ASA 7.2.5 cluster, IP=X.147.1.110 (primary cluster address) for management.

- the acl on the interface allows the connection, and shows hits

- ssh is allowed "ssh Y.35.252.0 255.255.254.0 elink"

- fw is sending a TCP reset (service resetinbound and service resetoutside are set)

- packet tracer shows

# packet-tracer input elink tcp Y.35.252.89 9999 X.147.1.110 22

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in X.147.1.0 255.255.255.0 elink

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Anyone know why this is failing? elink is the middle security level of the three interfaces, and there are PATs on X.147.1.110, that is, traffic leaving elink is being hidden behind X.147.1.110.

ASA implicit drop

Julio Carvajal — Thu, 06 Dec 2012 00:12:22 GMT

Hello ,

If you are trying to innitiate sessions from behind the X interface of the ASA to the Ip address of the X interface, then you need the following:

- ssh 0 0 inside ( or the name)

- a crypto key on your ASA

CRYPTO key generate rsa

Let me know how it goes.

ASA implicit drop

adamcarteratcisco — Thu, 06 Dec 2012 00:23:52 GMT

- ssh 0 0 inside ( or the name)

This is already achieved with the line "ssh Y.35.252.0 255.255.254.0 elink". The source of the connection is Y.35.252.0/23 and the interface name is elink.

- a crypto key on your ASA

CRYPTO key generate rsa

Yep - that's already been done.

Is there a way to verify the sshd is running? Something like ps on unix?

Re: ASA implicit drop

Julio Carvajal — Thu, 06 Dec 2012 00:35:10 GMT

Hello,

Can you run a debug SSH 255 and then attemtp to connect,

What logs is the firewall showing you?

Also the show asp table socket

Regards,