(acl-drop) Flow is denied by configured rule

[mahesh18]

Hi,

ACL is configured.

Below is result of packet tracer

packet-tracer input outside udp 172.24.93.24 1024 192.168.80.1 4223

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
class-map inspection_default
match default-inspection-traffic
policy-map global_policy
class inspection_default
inspect http
service-policy global_policy global
Additional Information:

Phase: 6
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: NAT
Subtype: rpf-check
Result: DROP
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
dynamic translation to pool 1 (10.61.31.22)
translate_hits = 57990, untranslate_hits = 972
Additional Information:

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Regards

MAhesh

[ryancisco01]

I don't know your setup, however it appears this is VPN traffic, and you would usually not want to nat vpn traffic. I would suggest creating a "NAT 0" statement for your VPN traffic and try again.

[mahesh18]

yes it is vpn traffic and we have nat 0 acl.

nat 0 acl has source as any and destination is 10.61.x.x

Regards

MAhesh

[ryancisco01 · Accepted solution]

what does destination of 10.61.x.x in your NAT 0 have to do with this traffic you are testing:

packet-tracer input outside udp 172.24.93.24 1024 192.168.80.1 4223

a valid NAT 0 for this traffic would have 192.168.80.1 as the destination

[Dinesh Moudgil · Accepted solution]

Hi Mahesh,

Can you please create additional entry in the nat 0 acl so the nat looks like

access-list name extended permit ip any 10.61.x.x mask

access-list name extended permit ip 10.61.x.x mask any

Please test and let me know how it fares.

Regards,
Dinesh Moudgil

P.S. Please rate helpful posts.