topic How to determine if ASA is blocking Traffic or not? in Network Security

How to determine if ASA is blocking Traffic or not?

mahesh18 — Tue, 12 Mar 2019 00:09:33 GMT

Hi everyone,

i am supporting ASA in client office.I am new to ASA world.

Users mostly ask for to check if ASA is allowing specfic port or not.

I do not know how can i check that.

Is there any way that i can determine if ASA is blocking port or not?

If ASA is blocking port what steps i need to take to allow the ASA to allow the specif port?

regards

mahesh

How to determine if ASA is blocking Traffic or not?

Muhammad Thanveer — Tue, 16 Oct 2012 05:00:11 GMT

This is very simple,

Do telnet example

go to command prompt

telnet destination ip addresss port no

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."

Re: How to determine if ASA is blocking Traffic or not?

Muhammad Thanveer — Tue, 16 Oct 2012 05:12:52 GMT

Dear Mahesh,

Some times port for the server may not be enabled on the server it self, in that scenario you will not be able to do telnet from the source, hence you should first do telnet from the same server segment ip series, because there may be no firewall in the same server segment, if you are able to do telnet from same server segment ip then server side is ok .

Now if you are able to do telnet from source machine, then port is ok from server side and asa is allowing the traffic.

If you are doing from the client machine and you are uinable to do telnet then asa is not allowing the traffic and there is no issue from server side.

If you are not able to do telnet from same server ip series itself then port is not enabled on server itself.

Plese rate if information provided is helpful.

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."

Re: How to determine if ASA is blocking Traffic or not?

Julio Carvajal — Tue, 16 Oct 2012 12:17:38 GMT

Hello Mahesh,

Run an scan using Nmap or any other scanning tool,

If the port is being blocked just create the proper ACL changes to make it work , nat might be required as well.

Any other question..Sure..Just remember to rate all of the helpful posts

Julio

How to determine if ASA is blocking Traffic or not?

mathieupoussin — Tue, 16 Oct 2012 14:25:13 GMT

Use the packet-tracer command on the firewall, like this :

packet-tracer input scr-inside tcp 192.168.3.67 9999 8.8.8.8 80

(scr-inside = input interface) then source ip/port and destination ip/port

Re: How to determine if ASA is blocking Traffic or not?

Muhammad Thanveer — Wed, 17 Oct 2012 04:50:38 GMT

nice command Mathieu.

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."

How to determine if ASA is blocking Traffic or not?

mahesh18 — Tue, 23 Apr 2013 01:00:34 GMT

Hi Thannveer,

Many thanks for reply.

Regards

Mahesh