topic packet tracer showing drop in Network Security

packet tracer showing drop

Kashish_Patel — Tue, 12 Mar 2019 00:10:29 GMT

My firewall is running on 8.2(5)33 version. I am facing a problem where config looks fine, but still firewall is dropping packet (I saw this in packet tracer).

I am pasting packet tracer output below. In the final result, it says acl-drop, but ACL is allowing icmps as shown in phase 2. What am I missing?

fw1# packet-tracer input inside icmp 172.25.28.23 2 3 1.1.1.1

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 2

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group to-outside in interface inside

access-list to-outside extended permit icmp any any

Additional Information:

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: NAT

Subtype:

Result: DROP

Config:

nat (inside) 2 access-list nat-to-fixed-global-ip

match ip inside host 172.25.28.23 outside host 1.1.1.1

dynamic translation to pool 2 (<nat IP>)

translate_hits = 4, untranslate_hits = 0

Additional Information:

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

packet tracer showing drop

Jennifer Halim — Wed, 17 Oct 2012 05:32:02 GMT

It's dropping due to NAT on Phase 5 of your packet tracer output.

Check the NAT statement to see if it has been correctly configured, and if you just configure a new translation statement, make sure that you have "clear xlate".

packet tracer showing drop

Kashish_Patel — Wed, 17 Oct 2012 06:01:39 GMT

Hi Jennifer,

Thanks for replying. I did "clear xlate". Still packet tracer is showing drop. Nat statement is correctly configured. If you want to check, I can share the config offline.

Thanks.

packet tracer showing drop

Jennifer Halim — Wed, 17 Oct 2012 06:57:52 GMT

What are you trying to test with packet tracer?

Ping? if it is, then it should have been:

packet-tracer input inside icmp 172.25.28.23 8 0 1.1.1.1

packet tracer showing drop

Kashish_Patel — Wed, 17 Oct 2012 07:12:59 GMT

I tried packet tracer as you updated :

packet-tracer input inside icmp 172.25.28.23 8 0 1.1.1.1

Could you tell me what does icmp type 8 mean and icmp code 0 mean?

packet tracer showing drop

cadet alain — Wed, 17 Oct 2012 07:22:30 GMT

Hi,

http://www.nthelp.com/icmp.html

Regards.

Alain

Don't forget to rate helpful posts.