Allow access to external SFTP site - Packet tracer results

[DarylBrooks]

Hi,

I'm trying to allow an internal address to access an external SFTP site on port 2022, however there seems to be an access-list denying the packets.

When I run the packet tracer, I receive the below results:

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xaca4b278, priority=11, domain=permit, deny=true
hits=1356658853, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

As there is nothing displayed in the 'Config:' line, how can I decipher the hex ID for the access-list that is causing the packets to be dropped, as there is not an access-list line with that hex value from what I can see in the config.

Thanks,

Daryl

[Marius Gunnerud]

Could you post the full output of the packet tracer?  The ACL in question is asigned to the input interface of the packet.  If you have configured an ACL entry for this traffic then chances are that either the ACL is incorrect or the packet tracer is incorrect.

--

Please remember to select a correct answer and rate helpful posts

[DarylBrooks]

Thanks for your reply, please see the full output below:

Phase: 1

Type: FLOW-LOOKUP

Subtype:

Result: ALLOW

Config:

Additional Information:

Found no matching flow, creating a new flow

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in   0.0.0.0         0.0.0.0         outside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: DROP

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in  id=0xaca4b278, priority=11, domain=permit, deny=true

        hits=1356658853, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0

        src ip=0.0.0.0, mask=0.0.0.0, port=0

        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:

input-interface: LINKSSG

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: drop

Drop-reason: (acl-drop) Flow is denied by configured rule

[Rahul Govindan]

Are the outside and LINKSSG interface at the same security level? The implicit drop may be due to the same security level rule not enabled. It won't show an acl name in packet tracer then.

[DarylBrooks]

They currently have different security levels:

interface Ethernet0/1
nameif LINKSSG
security-level 10

interface Ethernet0/0
speed 100
duplex full
nameif outside
security-level 0

[Marius Gunnerud · Accepted solution]

If there is an access list applied to the interface then the security level isn't condidered.

--

Please remember to select a correct answer and rate helpful posts

[DarylBrooks]

You were right, it appears an access-list 'inside_access_out' was applied to the interface linkssg.

I applied the below command: 

access-list inside_access_out line 132 extended permit tcp host 10.150.115.209 any eq 2022

All is now working, my problem was that I was trying to create a rule using a new access-list 'SFTPTest' as a test, rather than adding a line to the existing access list, which was applied to the interface.

Thanks to those that helped!

Daryl

[Marius Gunnerud · Accepted solution]

Check the LINKSSG interface ACL, and most likely you will have to add an entry to it to allow this traffic.

--

Please remember to select a correct answer and rate helpful posts

[samy.ccnp]

Hi ,

You have to must configure a ACL on inbound interface to allow this connection as this is being drooped by the Implicit deny Rule.

As once you configure any ACL entry on any of the higher security interface then there is no meaning of default traffic passing behaviour like from higher security zone to lower security zone. 

in that case you have to must define an ACL entry accordingly. 

Thanks.

Pls rememberer to select a correct answer and rate helpful posts