ACL Hit Counts

[Suresh Varghese]

ACL hit counts

Hi,

I jsut needed to clarify something, i have a data Center & branch Office connected to each other through IPSec VPN. I also have SSL-VPn configured on the firewall in my data center, the same firewall on which the IPSec VPn from my branch offfice terminates.

I retrieved some ACL logs from the ASA in the data center and all the hit counts shon are zero even when the connection is established and my branch office users are able to access all resources.

e.g. access-list CRYPTO_XXXXX line 8 extended permit ip x.x.x.x 255.255.0.0 y.y.y.y 255.255.255.0 (hitcnt=0) 0x8142efc9

All the ACL are like this where y.y.y.y is the branch office subnet

I also have another ACL which poped up on my SSL VPN ACL as shown below

e.g. access-list DAP-ip-user-906E4E06 line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y (hitcnt=22162) 0x440bdd04

access-list SSLVPN-CORP-ACL line 1 extended permit ip x.x.x.x 255.255.255.0 host y.y.y.y(hitcnt=0) 0xc9d27468

can anyone tell me why is my hit count is zero for both CRYPTO ACL and the SSLVPN-CORP-ACL even when the connection is established?

Second, what is DAP-ip-user-906E4E06? why is it showing such?

Thanks a lot in advance.

[Jennifer Halim · Accepted solution]

The crypto ACl will only show hitcount when it initiates the VPN tunnel. If the tunnel is initiated from the branch office, hitcount will increase on the branch office, not on the Data Center.

Here is the command for your reference:

http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2271080

The DAP-ip-user-xxxx is the Dynamic Access Policy can get created automatically depending on the policy configured on the ASA when the host connects.

Hope that helps.

[Suresh Varghese]

Hi Jennifer,

many thanks for the response.

I totally agree regarding the traffic initiation and hit count. I have totally 5 branch office and the same traffic initiation test when i try on the other branch offices, i can see the increase on their respective firewalls.

Any idea what might be wrong with the fiorst branch and why the hitcount does not increase.

The DAP policies were created 2-3 years back and i havent seen any such logs so far, i think this is the first time.

I have used RSA appliance for authenticating the users and remember enabling RADIUS on it. Will it cause of that.

regards