cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1256
Views
0
Helpful
2
Replies

ACL Hit Counts

Suresh Varghese
Beginner
Beginner

Hi,

I jsut needed to clarify something, i have a data Center & branch Office connected to each other through IPSec VPN. I also have SSL-VPn configured on the firewall in my data center, the same firewall on which the IPSec VPn from my branch offfice terminates.

I retrieved some ACL logs from the ASA in the data center and all the hit counts shon are zero even when the connection is established and my branch office users are able to access all resources.

e.g. access-list CRYPTO_XXXXX line 8 extended permit ip x.x.x.x 255.255.0.0 y.y.y.y 255.255.255.0 (hitcnt=0) 0x8142efc9

All the ACL are like this where y.y.y.y is the branch office subnet

I also have another ACL which poped up on my SSL VPN ACL as shown below

e.g. access-list DAP-ip-user-906E4E06 line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y (hitcnt=22162) 0x440bdd04

access-list SSLVPN-CORP-ACL line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y(hitcnt=0) 0xc9d27468

can anyone tell me why is my hit count is zero for both CRYPTO ACL and the SSLVPN-CORP-ACL even when the connection is established?

Second, what is DAP-ip-user-906E4E06? why is it showing such?

Thanks a lot in advance.

1 Accepted Solution

Accepted Solutions

Jennifer Halim
Cisco Employee
Cisco Employee

The crypto ACl will only show hitcount when it initiates the VPN tunnel. If the tunnel is initiated from the branch office, hitcount will increase on the branch office, not on the Data Center.

Here is the command for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2271080

The DAP-ip-user-xxxx is the Dynamic Access Policy can get created automatically depending on the policy configured on the ASA when the host connects.

Hope that helps.

View solution in original post

2 Replies 2

Jennifer Halim
Cisco Employee
Cisco Employee

The crypto ACl will only show hitcount when it initiates the VPN tunnel. If the tunnel is initiated from the branch office, hitcount will increase on the branch office, not on the Data Center.

Here is the command for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2271080

The DAP-ip-user-xxxx is the Dynamic Access Policy can get created automatically depending on the policy configured on the ASA when the host connects.

Hope that helps.

Hi Jennifer,

many thanks for the response.

I totally agree regarding the traffic initiation and hit count. I have totally 5 branch office and the same traffic initiation test when i try on the other branch offices, i can see the increase on their respective firewalls.

Any idea what might be wrong with the fiorst branch and why the hitcount does not increase.

The DAP policies were created 2-3 years back and i havent seen any such logs so far, i think this is the first time.

I have used RSA appliance for authenticating the users and remember enabling RADIUS on it. Will it cause of that.

regards

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers