topic Re: Denied ICMP type=3, code=3 in Network Security

Denied ICMP type=3, code=3

support.edm — Mon, 11 Mar 2019 13:37:45 GMT

I've set the inside 172.17.193.x/24 cisco catalyst switches to sync with an outside time server 66.96.30.91.

I'm getting the following

Built inbound ICMP connection for faddr 66.96.30.91/0 gaddr x.x.x.x/0 laddr 172.17.193.52/123

Teardown ICMP connection for faddr 66.96.30.91/0 gaddr x.x.x.x/0 laddr 172.17.193.52/123

Built inbound ICMP connection for faddr 66.96.30.91/0 gaddr x.x.x.x/0 laddr 172.17.193.53/123

Teardown ICMP connection for faddr 66.96.30.91/0 gaddr x.x.x.x/0 laddr 172.17.193.53/123

Denied ICMP type=3, code=3 from 66.96.30.91 on interface outside

Any ideas why???

Here is the config of my ASA:

ciscoasa# sh run

: Saved

ASA Version 8.0(4)

hostname ciscoasa

enable password xxx

passwd xxxx

names

interface Ethernet0/0

speed 100

duplex full

nameif outside

security-level 0

ip address outsideip 255.255.255.240

interface Ethernet0/1

speed 100

duplex full

nameif inside

security-level 100

ip address 172.17.193.100 255.255.255.0

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

boot config disk0:/exit

ftp mode passive

clock timezone mst -7

clock summer-time mdt recurring

access-list split_tunnel_list standard permit 172.17.193.0 255.255.255.0

access-list inside_nat0_outbound extended permit ip 172.17.193.0 255.255.255.0 192.168.10.0 255.255.255.0

access-list inbound_on_outside extended permit icmp any any

access-list inbound_on_outside extended permit tcp any host outsideip eq 5555

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu management 1500

ip local pool vpnuserspool 192.168.10.101-192.168.10.254 mask 255.255.255.0

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp deny any outside

asdm image disk0:/asdm-613.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 1 172.17.193.0 255.255.255.0

static (inside,outside) tcp outsideip 5555 172.17.193.96 5555 netmask 255.255.255.255

access-group inbound_on_outside in interface outside

route outside 0.0.0.0 0.0.0.0 gw 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

Re: Denied ICMP type=3, code=3

support.edm — Fri, 29 Aug 2008 18:03:31 GMT

http server enable

http 192.168.10.0 255.255.255.0 inside

http 172.17.193.0 255.255.255.0 inside

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set firstset esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map dyn1 1 set transform-set firstset

crypto dynamic-map dyn1 1 set security-association lifetime seconds 28800

crypto dynamic-map dyn1 1 set security-association lifetime kilobytes 4608000

crypto dynamic-map dyn1 1 set reverse-route

crypto map mymap 1 ipsec-isakmp dynamic dyn1

crypto map mymap interface outside

crypto isakmp enable outside

crypto isakmp policy 1

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 43200

crypto isakmp nat-traversal 3600

telnet timeout 5

ssh 172.17.193.0 255.255.255.0 inside

ssh 192.168.10.0 255.255.255.0 inside

ssh timeout 60

console timeout 0

management-access inside

dhcpd address 172.17.193.101-172.17.193.254 inside

dhcpd dns 172.17.193.6 interface inside

dhcpd enable inside

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp server 66.96.30.91 source outside

group-policy vpnuserspolicy internal

group-policy vpnuserspolicy attributes

split-tunnel-policy tunnelspecified

split-tunnel-network-list value split_tunnel_list

address-pools value vpnuserspool

username admin password xxx encrypted privilege 15

username admin attributes

vpn-group-policy vpnuserspolicy

tunnel-group vpnusersgroup type remote-access

tunnel-group vpnusersgroup general-attributes

default-group-policy vpnuserspolicy

tunnel-group vpnusersgroup ipsec-attributes

pre-shared-key *

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

service-policy global_policy global

prompt hostname context

Cryptochecksum:xxx

: end

ciscoasa#

Re: Denied ICMP type=3, code=3

robertson.michael — Fri, 29 Aug 2008 18:12:39 GMT

Hi,

Try enabling ICMP inspection with the following commands:

policy-map global_policy

class inspection_default

inspect icmp

Hope that helps.

-Mike

Re: Denied ICMP type=3, code=3

support.edm — Fri, 05 Sep 2008 15:41:18 GMT

I did that...still the same error. The ASA and the switches are not syncing properly with the external time source.

Any ideas?

Re: Denied ICMP type=3, code=3

g.meerkoetter — Fri, 05 Sep 2008 17:55:55 GMT

Hmm, if the remote host 66.96.30.91 sends icmp type 3 code 3 (aka port unreachable), then there

is no server running on port 123/udp (or maybe it's explicitely configured to pretend that it is not running).

I get the same answer here, therefore I'd suggest you try with a server that is known to be working.