topic ASA5510 Port Question in Network Security

ASA5510 Port Question

smitty0375 — Mon, 11 Mar 2019 21:08:56 GMT

Hey guys, I am using an ASA5510 for internal firewalling in my QA environment. How do I allow RDP from one subnet to those protected by the firewall? Preferably using the ASDM. Thanks!!

ASA5510 Port Question

Collin Clark — Mon, 08 Aug 2011 16:22:02 GMT

Sorry I don't use the ASDM, but referencing the CLI below you can probably figure it out

access-list inside_dmz permit tcp host 192.168.1.1 host 10.10.10.5 eq 3389

inside_dmz is the acl applied to the specifi interface. You will need to add the line above to permit access.

192.168.1.1 is the source, your PC, the destination is 10.10.10.5, your server. 3389 is the tcp port number for RDP.

Hope it helps.

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 16:50:16 GMT

Hi Jerry,

Could you elaborate a bit more, can you tell me what is going to be your source interface and the destination interface??

Are both te source and the destination behind the same interface??

-Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 16:50:34 GMT

Thanks for the reply. Is there a way to do this for a network rather than a host?

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 16:53:07 GMT

My main subnet is 10.30.x.x and I have a qa environment with 3 vlans and those subnets are to be locked down from one another via rule sets. The networks are 10.16.48, 10.16.100 and 10.16.101 respectively. I'm using the 4th interface as inside and to manage the ASA. I need to be able to rdp from 10.30.x.x into those machines.

Did I explain that properly? Thanks for all the help so far!

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 16:53:56 GMT

And in case it isn't obvious this is all internal no vpns etc.

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 16:55:50 GMT

HI Jerry,

Still a bit unclear, behind which interface do u have 10.30.xx.xx and behind which interafce do you have the three subnets???

What version of ASA are you using??

-Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 16:59:38 GMT

The 10.30.x.x is coming in thru E0/0 which I have labeled inside. This is all internal no outside interfaces. The other 3 subnets are on e0/1 2 and 3. ASDM is 6.4 and I don't recall asa but it's 8.x

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 17:01:13 GMT

Hi Jerry,

If all the subnets are behind the inside interface, then what you are trying to do is called hairpinnning the traffic, and you would need the following config:

static (inside,inside) 10.16.48.0 10.16.48.0 norand nailed

static (inside,inside) 10.16.100.0 10.16.100.0 norand nailed

static (inside,inside) 10.16.101.0 10.16.101.0 norand nailed

nat (inside) 1 0.0.0.0 0.0.0.0

global (inside) 1 interface

same-security-traffic permit intra-interface.

Hoep this is what you were looking for.

Thanks,

Varun

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 17:09:11 GMT

Then you migth need this:

static (,inside) 10.16.48.0 10.16.48.0

static (,inside) 10.16.100.0 10.16.100.0

static (,inside) 10.16.101.0 10.16.101.0

apart from that not sure if you have any interafce ACL's on inside interface, so you may need to allow the traffic there as well.

Thats the reason why I needed the interface names, moreover if you have "no nat-control" enabled then you would not even need this static statements, just the ACL would do. This is what I could gather from the information provided.

Moreover, if you are using any ASA version greater than 8.3, then this whole static statement would change, since there is a syntax change in it. So opening up the ASDM would help.

-Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 17:38:21 GMT

Here's my config:

Result of the command: "sh run"

: Saved

ASA Version 8.0(5)

hostname

interface Ethernet0/0

nameif inside

security-level 100

ip address 10.0.0.199 255.255.255.0

interface Ethernet0/1

nameif 48

security-level 100

ip address 10.16.48.1 255.255.255.0

interface Ethernet0/2

nameif 100

security-level 100

ip address 10.16.100.1 255.255.255.0

interface Ethernet0/3

nameif 101

security-level 100

ip address 10.16.101.1 255.255.255.0

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot system disk0:/asa805-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name daxko

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit udp any any

access-list inside_access_in extended permit icmp any any

access-list inside_access_in extended permit tcp any any

access-list 100_access_in extended permit icmp any any

access-list 100_access_in extended permit ip any any

access-list 100_access_in extended permit tcp any any

access-list 100_access_in extended permit udp any any

access-list 48_access_in extended permit icmp any any

access-list 48_access_in extended permit ip any any

access-list 48_access_in extended permit tcp any any

access-list 48_access_in extended permit udp any any

access-list 101_access_in extended permit ip any any

access-list 48_access_out extended permit icmp any any

access-list 48_access_out extended permit ip any any inactive

access-list 48_access_out extended permit tcp any any inactive

access-list 48_access_out extended permit udp any any inactive

access-list 100_access_out extended permit icmp any any

access-list 100_access_out extended permit tcp any any inactive

access-list 100_access_out extended permit udp any any inactive

access-list 100_access_out extended permit ip any any inactive

access-list inside_access_out extended permit icmp any any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu 48 1500

mtu 100 1500

mtu 101 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-641.bin

no asdm history enable

arp timeout 14400

global (48) 101 interface

nat (inside) 101 0.0.0.0 0.0.0.0

access-group inside_access_in in interface inside

access-group inside_access_out out interface inside

access-group 48_access_in in interface 48

access-group 48_access_out out interface 48

access-group 100_access_in in interface 100

access-group 100_access_out out interface 100

access-group 101_access_in in interface 101

route inside 0.0.0.0 0.0.0.0 10.0.0.199 1

route inside 10.2.0.0 255.255.255.0 Gateway 1

route inside 10.10.0.0 255.255.255.0 Gateway 1

route inside 10.30.0.0 255.255.255.0 Gateway 1

route inside 10.31.0.0 255.255.255.0 Gateway 1

route inside 10.32.0.0 255.255.255.0 Gateway 1

route inside 10.33.0.0 255.255.255.0 Gateway 1

route inside 10.34.0.0 255.255.255.0 Gateway 1

route inside 10.252.252.0 255.255.255.0 Gateway 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.32.0.0 255.255.255.0 inside

http 10.30.0.0 255.255.255.0 inside

http 10.0.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

client-update enable

telnet 10.30.0.0 255.255.255.0 inside

telnet 10.32.0.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum 512

message-length maximum client auto

service-policy global_policy global

prompt hostname context

Cryptochecksum:70805219682c54ff5366e7de8d98fef9

: end

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 17:49:32 GMT

then you would need just these:

static (48,inside) 10.16.48.0 10.16.48.0

static (100,inside) 10.16.100.0 10.16.100.0

static (101,inside) 10.16.101.0 10.16.101.0

Try it and let me know if this works.

Thanks,

Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 18:03:00 GMT

I added those and I still cannot reach any of the subnets. (Thanks so much for your help so far) Any other ideas?

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 18:10:33 GMT

Hi Jerry,

We then might to go the troubleshooting way:

packet-tracer input inside tcp 2345 3389 detailed

can you provide one output of this command.

-Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 18:16:23 GMT

Result of the command: "packet-tracer input inside tcp 10.30.0.23 2345 10.16.48.170 3389"

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.16.48.0 255.255.255.0 48

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group inside_access_in in interface inside

access-list inside_access_in extended permit ip any any

Additional Information:

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (inside) 101 0.0.0.0 0.0.0.0

match ip inside any 48 any

dynamic translation to pool 101 (10.16.48.1 [Interface PAT])

translate_hits = 2, untranslate_hits = 0

Additional Information:

Dynamic translate 10.30.0.23/2345 to 10.16.48.1/46119 using netmask 255.255.255.255

Phase: 6

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 101 0.0.0.0 0.0.0.0

match ip inside any inside any

dynamic translation to pool 101 (No matching global)

translate_hits = 0, untranslate_hits = 0

Additional Information:

Phase: 7

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: 48

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

ASA5510 Port Question

varrao — Mon, 08 Aug 2011 18:26:22 GMT

I guess we might have nailed it, you would need to add this acl:

access-list 48_access_out extended permit ip any any

in your config, it is inactive at the moment and that is why the traffic is dropping.

Let me know if we are going in right direction, otherwise another output of packet-tracer

Thanks,

Varun

ASA5510 Port Question

smitty0375 — Mon, 08 Aug 2011 19:02:06 GMT

Here's another output. So far no worky. Thanks!

Result of the command: "packet-tracer input inside tcp 10.30.0.23 2345 10.16.48.170 3389 detailed"

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.16.48.0 255.255.255.0 48

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group inside_access_in in interface inside

access-list inside_access_in extended permit ip any any

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd66fe6c8, priority=12, domain=permit, deny=false

hits=2, user_data=0xd66f6f48, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd6bbd568, priority=0, domain=permit-ip-option, deny=true

hits=3053, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (inside) 101 0.0.0.0 0.0.0.0

match ip inside any 48 any

dynamic translation to pool 101 (10.16.48.1 [Interface PAT])

translate_hits = 3, untranslate_hits = 0

Additional Information:

Dynamic translate 10.30.0.23/2345 to 10.16.48.1/48931 using netmask 255.255.255.255

Forward Flow based lookup yields rule:

in id=0xd6c179c0, priority=1, domain=nat, deny=false

hits=3, user_data=0xd67b8f60, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 101 0.0.0.0 0.0.0.0

match ip inside any inside any

dynamic translation to pool 101 (No matching global)

translate_hits = 0, untranslate_hits = 0

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd6b5b340, priority=1, domain=host, deny=false

hits=1639, user_data=0xd6b5b020, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 7

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group 48_access_out out interface 48

access-list 48_access_out extended permit ip any any

Additional Information:

Forward Flow based lookup yields rule:

out id=0xd6b93850, priority=12, domain=permit, deny=false

hits=1, user_data=0xd6b93810, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 8

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Reverse Flow based lookup yields rule:

in id=0xd6c0fe10, priority=0, domain=permit-ip-option, deny=true

hits=4974, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 9

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 11525, packet dispatched to next module

Module information for forward flow ...

snp_fp_inspect_ip_options

snp_fp_tcp_normalizer

snp_fp_translate

snp_fp_adjacency

snp_fp_fragment

snp_fp_tracer_drop

snp_ifc_stat

Module information for reverse flow ...

snp_fp_inspect_ip_options

snp_fp_translate

snp_fp_tcp_normalizer

snp_fp_adjacency

snp_fp_fragment

snp_fp_tracer_drop

snp_ifc_stat

Phase: 10

Type: ROUTE-LOOKUP

Subtype: output and adjacency

Result: ALLOW

Config:

Additional Information:

found next-hop 10.16.48.170 using egress ifc 48

adjacency Active

next-hop mac address 0050.569d.2bfd hits 0

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: 48

output-status: up

output-line-status: up

Action: allow

ASA5510 Port Question

smitty0375 — Tue, 09 Aug 2011 15:11:26 GMT

Hello. Success on part of it! I can now remote into a 10.16.48.x machine. Now can someone assist me in adding 10.16.100 and 10.16.101?

Here's my config.

Result of the command: "sh run"

: Saved

ASA Version 8.0(5)

dns-guard

interface Ethernet0/0

nameif inside

security-level 100

ip address 10.0.0.199 255.255.255.0

interface Ethernet0/1

nameif 48

security-level 100

ip address 10.16.48.1 255.255.255.0

interface Ethernet0/2

nameif 100

security-level 100

ip address 10.16.100.1 255.255.255.0

interface Ethernet0/3

nameif 101

security-level 100

ip address 10.16.101.1 255.255.255.0

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot system disk0:/asa805-k8.bin

ftp mode passive

dns server-group DefaultDNS

domain-name daxko

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list inside_access_in extended permit ip any any

access-list inside_access_in extended permit udp any any

access-list inside_access_in extended permit icmp any any

access-list inside_access_in extended permit tcp any any

access-list 100_access_in extended permit icmp any any

access-list 100_access_in extended permit ip any any

access-list 100_access_in extended permit tcp any any

access-list 100_access_in extended permit udp any any

access-list 48_access_in extended permit icmp any any

access-list 48_access_in extended permit ip any any

access-list 48_access_in extended permit tcp any any

access-list 48_access_in extended permit udp any any

access-list 101_access_in extended permit ip any any

access-list 48_access_out extended permit icmp any any

access-list 48_access_out extended permit ip any any

access-list 48_access_out extended permit tcp any any inactive

access-list 48_access_out extended permit udp any any inactive

access-list 100_access_out extended permit icmp any any

access-list 100_access_out extended permit tcp any any inactive

access-list 100_access_out extended permit udp any any inactive

access-list 100_access_out extended permit ip any any inactive

access-list inside_access_out extended permit icmp any any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu 48 1500

mtu 100 1500

mtu 101 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-641.bin

no asdm history enable

arp timeout 14400

global (48) 101 interface

nat (inside) 101 0.0.0.0 0.0.0.0

static (48,inside) 10.16.48.0 10.16.48.0 netmask 255.255.255.255

static (100,inside) 10.16.100.0 10.16.100.0 netmask 255.255.255.255

static (101,inside) 10.16.101.0 10.16.101.0 netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group inside_access_out out interface inside

access-group 48_access_in in interface 48

access-group 48_access_out out interface 48

access-group 100_access_in in interface 100

access-group 100_access_out out interface 100

access-group 101_access_in in interface 101

route inside 0.0.0.0 0.0.0.0 10.0.0.199 1

route inside 10.2.0.0 255.255.255.0 Gateway 1

route inside 10.10.0.0 255.255.255.0 Gateway 1

route inside 10.30.0.0 255.255.255.0 Gateway 1

route inside 10.31.0.0 255.255.255.0 Gateway 1

route inside 10.32.0.0 255.255.255.0 Gateway 1

route inside 10.33.0.0 255.255.255.0 Gateway 1

route inside 10.34.0.0 255.255.255.0 Gateway 1

route inside 10.252.252.0 255.255.255.0 Gateway 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.32.0.0 255.255.255.0 inside

http 10.30.0.0 255.255.255.0 inside

http 10.0.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

client-update enable

telnet 10.30.0.0 255.255.255.0 inside

telnet 10.32.0.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum 512

message-length maximum client auto

service-policy global_policy global

prompt hostname context

Cryptochecksum:d08113f8d49b927b3a0777acae8c1f45

: end

ASA5510 Port Question

smitty0375 — Tue, 09 Aug 2011 15:19:24 GMT

When I do a packet trace, this is what I get.

Result of the command: "packet-tracer input inside tcp 10.30.0.23 2345 10.16.100.167 3389 detailed"

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 10.16.100.0 255.255.255.0 100

Phase: 3

Type: ACCESS-LIST

Subtype: log

Result: ALLOW

Config:

access-group inside_access_in in interface inside

access-list inside_access_in extended permit ip any any

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd66fe6c8, priority=12, domain=permit, deny=false

hits=31, user_data=0xd66f6f48, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd6bbd568, priority=0, domain=permit-ip-option, deny=true

hits=4070, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5

Type: NAT

Subtype:

Result: DROP

Config:

nat (inside) 101 0.0.0.0 0.0.0.0

match ip inside any 100 any

dynamic translation to pool 101 (No matching global)

translate_hits = 4, untranslate_hits = 0

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd6b5cbd0, priority=1, domain=nat, deny=false

hits=4, user_data=0xd68b28c8, cs_id=0x0, flags=0x0, protocol=0

src ip=0.0.0.0, mask=0.0.0.0, port=0

dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: 100

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

ASA5510 Port Question

varrao — Tue, 09 Aug 2011 16:33:18 GMT

Hi Jerry,

Really happy, its worked, you now just need to asdd these:

global (100) 101 interface

global (101) 101 interface

and add these well:

access-list 100_access_out extended permit ip any any

and we should be good.

Let me know if this works.

Thanks,

Varun