topic Re: ASA 5520 ACL Counters not Incrementing in Network Security

ASA 5520 ACL Counters not Incrementing

Michael All — Mon, 11 Mar 2019 20:29:25 GMT

Hello everyone:

Has anyone seen an ASA not record hit against an ACL? I have two 5520s in a Primary/Secondary configuration, versions 8.4(1) and ASDM 6.4(1). There are several ACLs that are all recording zero hits but I know for a fact that those are what are matching for them to get out.

Any thoughts would be appreciated!

Thanks,

Mike

Re: ASA 5520 ACL Counters not Incrementing

Pavel Pokorny — Thu, 05 May 2011 06:37:39 GMT

Hi,

I depends on purpose of ACL.

If is used for NAT, then no hits will show.

HTH

Pavel

Re: ASA 5520 ACL Counters not Incrementing

Michael All — Thu, 05 May 2011 14:51:47 GMT

Thanks for the response Pavel, but these are not being used to define a NAT. Any other situations that could reflect this?

Mike

Re: ASA 5520 ACL Counters not Incrementing

Maykol Rojas — Thu, 05 May 2011 18:58:20 GMT

Michael,

Are those ACL's poiting to the translated or to the realIP address?

Mike

Re: ASA 5520 ACL Counters not Incrementing

varrao — Thu, 05 May 2011 19:06:26 GMT

Hi Micheal,

Could you verify if you are able to see the hit count from the CLI, by doing "show access-list". This could be an issue with the ASDM itself, it may not able to calculate the MD5 hash value for the ACL.

Could youm also tell me if those particular ACL's contain any network object for protocol???

Thanks,

Varun

Re: ASA 5520 ACL Counters not Incrementing

Pavel Pokorny — Fri, 06 May 2011 06:16:49 GMT

Hi Mike,

Can you put the ACL here and tell me purpose?

If there are any groups (networks, services) please decode them.

Thanks

Pavel

Re: ASA 5520 ACL Counters not Incrementing

Michael All — Mon, 09 May 2011 15:46:32 GMT

Pavel,

One of them is for allowing VPN and SSH connections out:

True

172.20.0.0/255.255.0.0

any

VPNAccess
tcp/ssh

Permit

Default

Notes

The "VPNAccess" Service Group is grouping TCP/10000, UDP/4500, UDP/isakmp, and UDP/10000

Re: ASA 5520 ACL Counters not Incrementing

Michael All — Mon, 09 May 2011 15:52:48 GMT

Varun,

Looks like you might have called it... CLI is showing hits while the ASDM is not. Any thoughts on how to resolve this?

access-list inside_access_in line 18 extended permit object-group DM_INLINE_SERVICE_19 object 172.20.0.0 any 0x6c207492

access-list inside_access_in line 18 extended permit udp 172.20.0.0 255.255.0.0 any eq 4500 (hitcnt=118) 0xd4341637

access-list inside_access_in line 18 extended permit udp 172.20.0.0 255.255.0.0 any eq isakmp (hitcnt=251) 0xd65313e6

access-list inside_access_in line 18 extended permit tcp 172.20.0.0 255.255.0.0 any eq ssh (hitcnt=580) 0x6e035ce4

access-list inside_access_in line 18 extended permit tcp 172.20.0.0 255.255.0.0 any eq 10000 (hitcnt=13) 0x2a249aa3

access-list inside_access_in line 18 extended permit udp 172.20.0.0 255.255.0.0 any eq 10000 (hitcnt=8) 0xf7e045eb

Re: ASA 5520 ACL Counters not Incrementing

varrao — Mon, 09 May 2011 17:10:26 GMT

Micheal,

In the ASDM under firewall dashboard, do you see a message for config out of sync? If yes,this might be a known issue withe ASA, my suggestions to you would be to open a TAC case for further investigation on it.

Hope this helps.

Thanks,

Varun

Re: ASA 5520 ACL Counters not Incrementing

Pavel Pokorny — Mon, 09 May 2011 17:34:50 GMT

Varun,

You're probably right.

I've seen this behaviour under different types os ASA code (8.2.4 ie) and also ASDM (6.3.x).

So, maybe TAC will help and devel update code of ASDM.

Bye

Pavel

Re: ASA 5520 ACL Counters not Incrementing

Michael All — Mon, 09 May 2011 18:14:54 GMT

Okay, makes sense, I'll open a ticket with Cisco. Thanks for the help guys.

Re: ASA 5520 ACL Counters not Incrementing

Maykol Rojas — Tue, 17 May 2011 20:47:02 GMT

Hi,

Here is the bug

http://tools.cisco.com/Support/BugToolKit/search/getBugDetails.do?method=fetchBugDetails&bugId=CSCtl99214

Cheers.

Mike