topic Re: How can i see traffic being dropped by Firewall? in Network Security

How can i see traffic being dropped by Firewall?

powermann — Mon, 11 Mar 2019 21:56:07 GMT

Hi All. I have a problem where users on the inside of my network cannot receive emails when they use outlook and windows live to external mail servers. If email is unencrypted (eg hotmail) there are no issues. If however email is encrypted ( gmail on por 465 or outlook over ssl) then the users can receive but cannot send emails. I have already disable inspect esmpt and i have removed any outbound access-list. I want to see if there is anything elese that could be blocking the traffic. How can i do that?

My Firewall config it attached.

Marlon

How can i see traffic being dropped by Firewall?

cadet alain — Mon, 28 Nov 2011 16:06:12 GMT

Hi,

you can use packet-tracer or capture packets on the ASA to see which is the problem.

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080a9edd6.shtml

http://www.brianyeager.org/?p=504

Regards.

Alain

How can i see traffic being dropped by Firewall?

josecalv — Mon, 28 Nov 2011 17:38:51 GMT

Hi,

I believe that ASP drop captures will work for you here.

capture asp type asp-drop all headers-only (With the headers-only the ASA won't capture the payload of the packet so the capture buffer won't fill so fast).

After that if you do "show cap asp | inc" and then the IP address that you are tracking here you will be able to see if there are packets dropped by the ASA (if any).

Re: How can i see traffic being dropped by Firewall?

powermann — Mon, 28 Nov 2011 18:37:39 GMT

Thanks for your help guys. I have tried both methods and i still cant see what is blocking it. Do you have any idea what can cause this behavior in the firewall even after the inspect esmtp has been removed?

Re: How can i see traffic being dropped by Firewall?

josecalv — Mon, 28 Nov 2011 22:12:05 GMT

Hi,

If the ASA is not dropping the packets and the ESMTP inspection is disabled what's makes you believe that this is firewall related?

We need to confirm that though. Could you share the packet captures (in pcap format) of one outbound failing connection on both incoming and outgoing interfaces of the firewall?

I have had some cases related to this and they all were problems related to the endpoints. Generally when an e-mail fails you receive an e-mail back with an error code. Are you receiving any of those by any chance? Maybe that could help.

Re: How can i see traffic being dropped by Firewall?

powermann — Tue, 29 Nov 2011 03:15:14 GMT

Hi Jose. I had by passed the firewall and the users worked fine. When they go back to their hotels they have no problems with emails. I even put a switch between the firewall and the outside/internet router and the email worked!

The only error you get is that there is a time out connecting to the server.

I will send the capture data when i get back to office. Thanks for your assistance.

Re: How can i see traffic being dropped by Firewall?

josecalv — Tue, 29 Nov 2011 14:03:36 GMT

Hi,

When you do that kind of tests there could be a lot of things that you could by bypassing as well. I am afraid to say that that is not a conclusive test as I have seen on many other cases.

I will be waiting for the captures here.

Re: How can i see traffic being dropped by Firewall?

powermann — Tue, 29 Nov 2011 17:13:21 GMT

Thanks for the reply Jose. I did a capture from my ip (172.17.12.100) going to smtp.gmail.com ( 74.125.157.102-109). The files are attached. Please let me know if you seen anything out of the ordinary. Much appreciated.

Re: How can i see traffic being dropped by Firewall?

powermann — Wed, 30 Nov 2011 15:49:23 GMT

Hi All. I found a work around for the problem. I took Jose's advice and looked at it from the end point and found that windows 7 handles tcp windowing diffrently than previous OS's. I still think there is an issue somewhere but i am not sure where esle to look so i will work with this for now.

See note below. Thanks for your help guys.

Disable the auto tuning

Check the state or current setting of TCP Auto-Tuning

1. Open elevated command prompt with administrator’s privileges.

2. Type the following command and press Enter:

netsh interface tcp show global

The system will display the following text on screen, where you can check on the Auto-Tuning setting:

Querying active state…

TCP Global Parameters

———————————————-

Receive-Side Scaling State : enabled

Chimney Offload State : enabled

Receive Window Auto-Tuning Level : normal

Add-On Congestion Control Provider : none

ECN Capability : disabled

RFC 1323 Timestamps : disabled

Disable TCP Auto-Tuning

1. Open elevated command prompt with administrator’s privileges.

2. Type the following command and press Enter:

netsh interface tcp set global autotuning=disabled

Enable TCP Auto-Tuning

1. Open elevated command prompt with administrator’s privileges.

2. Type the following command and press Enter:

netsh interface tcp set global autotuning=normal

http://www.mydigitallife.info/disable-tcp-auto-tuning-to-solve-slow-network-cannot-load-web-page-or-download-email-problems-in-vista/