topic Re: ASA Firewall error while adding SCTP in ACCESS LIST in Network Security

ASA Firewall error while adding SCTP in ACCESS LIST

HARIS_HUSSAIN — Fri, 21 Feb 2020 16:38:00 GMT

In ASA When i Try to add the SCTP protocol the ASDM give below error.Can any one help here to understand SCTP Options in ASA & why does it now work ?

Re: ASA Firewall error while adding SCTP in ACCESS LIST

Sheraz.Salim — Sat, 05 Jan 2019 18:49:59 GMT

you need to define a host/object network/object-group

for example.

access-list inside_in extended permit sctp any host 192.168.x.x

yo can not have access-list inside_in extended permit sctp any any

Re: ASA Firewall error while adding SCTP in ACCESS LIST

HARIS_HUSSAIN — Sun, 06 Jan 2019 07:57:36 GMT

I tried with SCTP command but ASA is unable to identify SCTP Protocol.

ciscoasa(config)# access-l TEST-1 ext permit sctp any host 192.168.10.1
^
ERROR: % Invalid input detected at '^' marker.
ciscoasa(config)# access-l TEST-1 ext permit s?

configure mode commands/options:
snp
ciscoasa(config)# access-l TEST-1 ext permit sctp ?
ERROR: % Unrecognized command
ciscoasa(config)# access-l TEST-1 ext permit sctp

Re: ASA Firewall error while adding SCTP in ACCESS LIST

Sheraz.Salim — Sun, 06 Jan 2019 10:40:57 GMT

what ASA version you running on ?

i test this command on 9.8 and it working.

Re: ASA Firewall error while adding SCTP in ACCESS LIST

Rob Ingram — Sun, 06 Jan 2019 11:45:50 GMT

It looks like SCTP protocol support was add in ASA v9.5, release notes.

As has Radio_City, I've confirmed it works on my image (9.9)

HTH

Re: ASA Firewall error while adding SCTP in ACCESS LIST

HARIS_HUSSAIN — Sun, 06 Jan 2019 12:20:13 GMT

Mine i s Software Version 9.1

Re: ASA Firewall error while adding SCTP in ACCESS LIST

Rob Ingram — Sun, 06 Jan 2019 13:35:18 GMT

What hardware are you running? If it's too old (5505, 5510, 5520 etc) it may not support the newer firmware versions.

Re: ASA Firewall error while adding SCTP in ACCESS LIST

Sheraz.Salim — Sun, 06 Jan 2019 14:55:32 GMT

just to add what RJI asid

check this matrix of software in regards to firewall hardware

https://www.cisco.com/c/en/us/td/docs/security/asa/compatibility/asamatrx.html#id_59423