topic outside host blocked in Network Security

outside host blocked

jimmylehto — Tue, 12 Mar 2019 00:20:31 GMT

I have a host on the outside i want to access

the problem is ASA 5505 has somehow blocked traffic to this host

i can find nothing in the shun list and there is no ACL rule stating that this specific host is blocked.

Where else can i check to see if it's blacklisted.

My home computer that is not behind any firewall easily access this host.

The host is also blocked from accessing the webpage behind my ASA

Also this website my home computer can access without any problems.

outside host blocked

mkdccie — Thu, 08 Nov 2012 15:35:41 GMT

Hi,

If you generate the traffic from inside to outside, you dont need ACL, and the ASA will know the returne traffic and allow that.

So you have something else that block it, can you ping that host from the firewall itself?

can you give more info about the network so we can help you?

Regards,

MKD

outside host blocked

jimmylehto — Fri, 09 Nov 2012 06:39:24 GMT

i have 1 webserver behind the ASA and alot of client computers.

i have 2 ubuntu computers outside directly to the internet they both run ftp servers.

I have my home computer that is not behind ASA

The clients on the inside wants to access both ubuntu ftp servers

Ubuntu 1 works great no problems whatsoever traceroute,ping,ftp,http.

Ubuntu 2 gets timeout on ftp client and no response to ping, traceroute, http.

On my home computer i can access both ubuntu servers perfectly fine.

When i logon to the ubuntu computers and start firefox to try and access the webserver behind the ASA

Ubuntu 1 works fine and no problems at all.

Ubuntu 2 gets server not responding.

here is my show access-list

http://dev.inetpro.org/pastebin/1644

outside host blocked

jimmylehto — Mon, 12 Nov 2012 06:44:10 GMT

Really no one who has any ideas on what it could be?

i've tried disabling basic threat detection but i see no difference.

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 01:55:20 GMT

Pls kindly share the ASA configuration, as well as the IP Address of client on the inside that you are trying to access those 2 Ubuntu server, and also the IP Address of both servers.

Are you trying to access the server by IP Address or by FQDN?

outside host blocked

jimmylehto — Tue, 13 Nov 2012 06:33:57 GMT

running configuration at

http://dev.inetpro.org/pastebin/1647

trying to access server by ip and dns name

inside client ip is 192.168.1.34

banned host has 87.253.75.44

the ASA outside ip is 87.253.75.42

non blocked host has ip 87.253.75.43

Also tried accessing the http that is behind the ASA and that only works from 87.253.75.43 and the 87.253.75.44 gets ACL denied

Nov 12 2012

16:14:46

710003

87.253.75.44

35168

87.253.75.42

TCP access denied by ACL from 87.253.75.44/35168 to inside:87.253.75.42/80

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 09:15:48 GMT

Your class map has been incorrectly configured.

You are matching any traffic and inspect it against PPTP and FTP which is incorrect.

You should only match it against the default protocol and ports.

To make it easy, just use the default inspection policy as follows:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect ftp

inspect pptp

inspect icmp

no service-policy global-policy-vpn global

service-policy global_policy global

outside host blocked

jimmylehto — Tue, 13 Nov 2012 09:22:33 GMT

Ok did what you suggested but i still have the same problem

new running config

http://dev.inetpro.org/pastebin/1648

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 11:42:17 GMT

Did you "clear xlate" after making the changes and try again?

Also, if you run packet tracer, where is it failing?

outside host blocked

jimmylehto — Tue, 13 Nov 2012 11:56:42 GMT

cleared xlate

Bsldurssonfw# clear xlate

INFO: 528 xlates deleted

Still no go

Packet tracer is sucessful

But still cannot access the host in question.

did a packet trace from inside 192.168.1.34 TCP 80

to 87.253.75.44 TCP 80

and it was "allowed"

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 12:36:45 GMT

If packet tracer is successful, then it is not issue on the ASA.

I would check the host itself.

Does it have dual NIC, or just the one NIC? is packet actually getting to it? and is it replying?

Are you able to ping the host from the ASA itself? Does the ASA have the correct ARP for that host?

outside host blocked

jimmylehto — Tue, 13 Nov 2012 12:40:53 GMT

the ASA is blocking it somehow.

i have remote control over the blocked host and if i open up a browser on it and surf to the ASA ip and i'm logging the connect attempt ASA logging is giving me this

Nov 13 2012

13:32:01

710003

87.253.75.44

35293

87.253.75.42

TCP access denied by ACL from 87.253.75.44/35293 to inside:87.253.75.42/80

on a computer not behind the ASA there is no problems getting to 87.253.75.44

but no clients behind the ASA can access it.

not sure what you mean by correct ARP host.

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 12:44:47 GMT

OK, try this:

object network rdpgate-http
 no nat (any,outside) static interface service tcp www www 
 nat (inside,outside) static interface service tcp www www

Then "clear xlate"

Then try to browse again from the blocked host to the ASA IP.

outside host blocked

jimmylehto — Tue, 13 Nov 2012 12:51:39 GMT

Done this also and no go.

it is only this ip 87.253.75.44 that is blocked in the ASA

another host 87.253.75.43 can access the www page behind the ASA without any problems.

outside host blocked

Jennifer Halim — Tue, 13 Nov 2012 12:57:25 GMT

If packet tracer is successful from and to 87.253.75.44, then it is unlikely it is an issue with the ASA.

If you change the ip address of the host to a different address, does it work? what is the default gateway of that host?

Re: outside host blocked

jimmylehto — Tue, 13 Nov 2012 13:00:18 GMT

all of them have the same gateway 87.253.75.41

Don't have any free IP's to change the blocked host to.

The ASA logging still says it's denied the TCP connection from 87.253.75.44 because a ACL rule.

Bsldurssonfw# ping 87.253.75.44

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 87.253.75.44, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)