topic Re: ASA 8.2 Packet tracer syntax for outside traffic in Network Security

ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Tue, 12 Mar 2019 00:11:25 GMT

hi,

what will be packet-tracer syntax to check if outside interface traffic is allowed to get to inside networks

thanks

mark

ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 17:55:17 GMT

Hello Mark,

Packet-tracer input outside tcp/udp/icmp outside_host_ip 1025 (random port) internal_global_ip 80 (specific application port)

Regards

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Thu, 18 Oct 2012 19:02:04 GMT

Hi Julio,

Thank you for your reply, it shows that it is blocked, I have attached config, please review to see what's missing, appreciate your help.

thanks

mark

asa# packet-tracer input outside tcp 10.170.0.5 1025 10.1.1.57 80

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.1.1.57 255.255.255.255 inside

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

asa#

ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 19:03:08 GMT

Hello,

Please attach the config again

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Thu, 18 Oct 2012 19:04:21 GMT

sorry, config attached

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 19:11:26 GMT

Hello Mark,

Do:

static (inside,outside) tcp interface 80 10.1.1.57 80

access-group acl-outside in interface outside

Then give it a try

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Thu, 18 Oct 2012 19:27:36 GMT

Hi,

it failed, here is the output & configuration I added, access group doesn't show up in configuration:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

asa# int vlan 2

asa(config-if)# access-group acl-outside in interface outside

asa# packet-tracer input outside tcp 10.170.0.5 1025 10.1.1.57 80

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.1.1.57 255.255.255.255 inside

Phase: 2

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group acl-outside in interface outside

access-list acl-outside extended permit ip 10.170.0.0 255.255.255.0 host 10.1.1.57

Additional Information:

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect http

service-policy global_policy global

Additional Information:

Phase: 5

Type: NAT

Subtype: rpf-check

Result: DROP

Config:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

match tcp inside host 10.1.1.57 eq 80 outside any

static translation to 10.8.8.1/80

translate_hits = 0, untranslate_hits = 0

Additional Information:

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

asa#

thanks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 19:38:16 GMT

Hello Mark,

Packet tracer syntax is wrong

Do the following

no route inside route inside 10.1.1.57 255.255.255.255 0.1.1.2 1

no route inside 10.1.1.0 255.255.255.0 10.1.1.2 1

Then

packet-tracer input outside tcp 10.170.0.5 1025 10.8.8.1 80

Remember to rate all of the helpful posts

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Thu, 18 Oct 2012 19:56:28 GMT

Hi,

won't let me add the route:

ERROR: Cannot add route, connected route exists

all outside traffic need to go that singl address.

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 19:59:32 GMT

Hello Mark,

Do not worry, actually I was trying to remove it.

Please run the packet tracer I sent

Remember to rate all of the helpful posts

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Thu, 18 Oct 2012 20:19:10 GMT

Hi,

here is the output, denied.

sa# packet-tracer input outside tcp 10.170.0.5 1025 10.8.8.1 80

Phase: 1

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

match tcp inside host 10.1.1.57 eq 80 outside any

static translation to 10.8.8.1/80

translate_hits = 0, untranslate_hits = 3

Additional Information:

NAT divert to egress interface inside

Untranslate 10.8.8.1/80 to 10.1.1.57/80 using netmask 255.255.255.255

Phase: 2

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

asa#

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Thu, 18 Oct 2012 21:24:15 GMT

Hello Mark,

Show run access-group

If nothing comes out add the following

access-group acl-outside in interface outside

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Fri, 19 Oct 2012 14:08:37 GMT

Hi Julio,

sorry for late reply, it shows up:

asa# sh run access-group

access-group acl-outside in interface outside

asa#

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Fri, 19 Oct 2012 16:22:31 GMT

Hello Mark,

That is weird, looks like we have all we need.

Can you share the updated configuration please?? So I can analize it

Regards.

Julio

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Fri, 19 Oct 2012 17:01:08 GMT

Hi Julio,

Pleae see config attached, thank you for all your help. I can ping customer devices from firewall but not from 10.1.1.57.

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Fri, 19 Oct 2012 17:06:31 GMT

Hello Mark,

I mean right now all we are testing is a HTTP connection to the 10.1.1.57 ( in this case pointing to the outside interface on port 80) from 10.170.0.5

access-list acl-outside extended permit ip 10.170.0.0 255.255.255.0 host 10.8.8.1

That will do it,

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Fri, 19 Oct 2012 17:16:25 GMT

Hi Julio,

it worked, still can't ping from 10.1.1.57

asa# packet-tracer input outside tcp 10.170.0.5 1025 10.8.8.1 80

Phase: 1

Type: UN-NAT

Subtype: static

Result: ALLOW

Config:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

match tcp inside host 10.1.1.57 eq 80 outside any

static translation to 10.8.8.1/80

translate_hits = 0, untranslate_hits = 4

Additional Information:

NAT divert to egress interface inside

Untranslate 10.8.8.1/80 to 10.1.1.57/80 using netmask 255.255.255.255

Phase: 2

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group acl-outside in interface outside

access-list acl-outside extended permit ip 10.170.0.0 255.255.255.0 host 10.8.8.1

Additional Information:

Phase: 3

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 4

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect http

service-policy global_policy global

Additional Information:

Phase: 5

Type: NAT

Subtype: rpf-check

Result: ALLOW

Config:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

match tcp inside host 10.1.1.57 eq 80 outside any

static translation to 10.8.8.1/80

translate_hits = 0, untranslate_hits = 4

Additional Information:

Phase: 6

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

static (inside,outside) tcp interface www 10.1.1.57 www netmask 255.255.255.255

match tcp inside host 10.1.1.57 eq 80 outside any

static translation to 10.8.8.1/80

translate_hits = 0, untranslate_hits = 4

Additional Information:

Phase: 7

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 8

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 545, packet dispatched to next module

Result:

input-interface: outside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

asa#

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Fri, 19 Oct 2012 17:34:23 GMT

Hello Mark,

What do you mean by

still can't ping from 10.1.1.57

What are you trying to do now??

Remember to rate all of the post that help

Re: ASA 8.2 Packet tracer syntax for outside traffic

marktaylor47 — Fri, 19 Oct 2012 17:41:47 GMT

Hi Julio,

I am trying to access 10.170.0.5 & other IP's in outside-acl, I can ping from firewall but not from 10.1.1.57.

This is the server which all remote devices in outside-acl will access. I can only ping 10.8.8.2 from 10.1.1.57.

thks

mark

Re: ASA 8.2 Packet tracer syntax for outside traffic

Julio Carvajal — Fri, 19 Oct 2012 17:54:38 GMT

Hello Mark,

If you want to ping outside users from inside hosts

do nat (inside) 1 0 0

Then try it.

Remember to rate all of the post that help