ASA is dropping packets between two internal hosts

kidsmed-it · ‎07-17-2011

I am a newbie to configuring a router and am setting one up for a small business that uses a client-server application against a SQL Server 2008 database. The router connectivity is working fine getting out to the Internet. An IPSEC VPN Tunnel has been built and working fine. It is the internal client to server access that's causing my headaches.

My problem is that I am not able to logon to the Server Database from my client workstations which are all part of a Windows 2008 Domain.

Connectivity is fine, I am able to ping between ASA and clients and DB server. The std ports 1433, 1434 used by Microsft Sql Services are listening.

From the ASDM, by running packet trace, any packets between the two servers are being dropped, even though I am able to ping, telnet all servers involved. The latest error messages show 'No Matching Global'.

Any help would be greatly appreciated and needed GREATLY.

MY ASA config is such:

ASA Version 8.2(1)
!
hostname xxxxxasa
domain-name phx.xxxxx.com
enable password xxxxxxxxxx encrypted
passwd xxxxxxx encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group pppoex
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 205.171.3.65
name-server 205.171.2.65
domain-name phx.xxxxxxx.com
same-security-traffic permit intra-interface
access-list icmp_ping extended permit icmp any any echo-reply
access-list ICMPACL extended permit icmp any any
access-list emds-nat extended permit ip host 192.168.1.7 192.168.50.0 255.255.255.0
access-list inside_acl extended permit ip 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any eq telnet
access-list inside_acl extended permit ip any any
access-list emds-crypto extended permit ip host 10.1.3.120 192.168.50.0 255.255.255.0
pager lines 24
logging enable
logging monitor debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-621.bin
asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 192.168.1.0 255.255.255.0
static (inside,outside) 10.1.3.120 access-list emds-nat
access-group inside_acl in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address emds-crypto
crypto map outside_map 20 set peer xxx.xxx.xxx.xxx
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group pppoex request dialout pppoe
vpdn group pppoex localname xxxxxxxx@qwest.net
vpdn group pppoex ppp authentication chap
vpdn username xxxxxxxx@qwest.net password *********
dhcpd dns 205.171.3.65 205.171.2.65
dhcpd lease 4500
dhcpd domain phx.xxxxxx.com
dhcpd auto_config outside
!
dhcpd address 192.168.1.10-192.168.1.137 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.1.9 config-20110710
webvpn
username xxxxxx-it password xxxxxxxxxxx encrypted privilege 15
username admin password xxxxxxxxxx encrypted privilege 15
username cisco password xxxxxxxxxx encrypted privilege 15
tunnel-group 66.999.99.999 type ipsec-l2l
tunnel-group 66.999.99.999 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:404416f0d532bfe08e01c59a29252c31
: end

My latest Packet trace:

kidsmedasa(config)# packet-tracer input inside udp 192.168.1.7 1434 192.168.1.$

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.1.0 255.255.255.0 inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_acl in interface inside
access-list inside_acl extended permit ip 192.168.1.0 255.255.255.0 any
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9ca1578, priority=12, domain=permit, deny=false
        hits=14308, user_data=0xc78c7170, cs_id=0x0, flags=0x0, protocol=0
        src ip=192.168.1.0, mask=255.255.255.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc957b5c8, priority=0, domain=permit-ip-option, deny=true
        hits=30455, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,outside) 10.1.3.120 access-list emds-nat
match ip inside host 192.168.1.7 outside 192.168.50.0 255.255.255.0
    static translation to 10.1.3.120
    translate_hits = 16, untranslate_hits = 0
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc95ea260, priority=5, domain=host, deny=false
        hits=10423, user_data=0xca0dc768, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=192.168.1.7, mask=255.255.255.255, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6
Type: NAT
Subtype:
Result: DROP
Config:
nat (inside) 10 0.0.0.0 0.0.0.0
match ip inside any inside any
    dynamic translation to pool 10 (No matching global)
    translate_hits = 4, untranslate_hits = 0
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc95dff60, priority=1, domain=nat, deny=false
        hits=3, user_data=0xc95de600, cs_id=0x0, flags=0x0, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

varrao · ‎07-17-2011

Hi Dustin,

Yes couple of thing missing in here, I guess you are try to do u-turning on the firewall, you would need the following config for it:

global (inside) 10 interface

static (inside,inside) 10.1.3.120

This shoudl u-turn the traffic on the firewall.

Plz let me know the real ip of th server and the mapped ip as well.

Hope this helps,

Thanks,

Varun

Thanks,
Varun Rao

kidsmed-it · ‎07-17-2011

The only mapping was for my web server and I am handling that with the following for vpn traffic.

static (inside,outside) 10.1.3.120 access-list emds-nat

My internal hosts are on 192.168.1.0/24.

kidsmed-it · ‎07-17-2011

Not a web server but an iis server as required by the application.

kidsmed-it · ‎07-17-2011

Varun,

Your Global and Static commands did the trick allowing packetys to go through. YEAHHH!

Unfortunately, I am unable to ping my database server from my clients. The ASDM software and via the CLI packet tracing says the packets are going through. And still not able to logon.

Thanks for getting me this far!

Dustin

varrao · ‎07-18-2011

Hey thats great !!!!!! try taking packet-tracer and packet capture for the icmp issue:

https://supportforums.cisco.com/docs/DOC-1222

Let me know how it goes.

Thanks,

Varun

Thanks,
Varun Rao

kidsmed-it · ‎07-18-2011

Hi Varun,

Hope you are out there. I have been doing my Packet sniffing with Wireshark and here is what I am getting.

3

Jul 18 2011

18:59:09

305006

192.168.1.12

regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.12 (type 0, code 0)

What is more bizarre is that this seems to be intermittent. I have kicked off 'ping -n 25 192.168.1.9' several times. Sometimes the Pings go thru, other times not. Getting the error above.

The ASDM offered this solution but since it is intermittent I am really stumped.

%ASA-3-305006: {outbound static|identity|portmap|regular) translation 
creation failed for protocol src interface_name:source_address/source_port dst 
interface_name:dest_address/dest_port

A protocol (UDP, TCP, or ICMP) failed to create a translation through the adaptive security appliance. The adaptive security appliance does not allow packets through that are destined for network or broadcast addresses. The adaptive security appliance provides this checking for addresses that are explicitly identified with static commands. For inbound traffic, the adaptive security appliance denies translations for an IP address identified as a network or broadcast address.

The adaptive security appliance does not apply PAT to all ICMP message types; it only applies PAT ICMP echo and echo-reply packets (types 8 and 0). Specifically, only ICMP echo or echo-reply packets create a PAT translation. As a result, when the other ICMP messages types are dropped, this message is generated.

The adaptive security appliance uses the global IP address and mask from configured static commands to differentiate regular IP addresses from network or broadcast IP addresses. If the global IP address is a valid network address with a matching network mask, then the adaptive security appliance does not create a translation for network or broadcast IP addresses with inbound packets.

For example:

static (inside,outside) 10.2.2.128 10.1.1.128 netmask 255.255.255.128

The adaptive security appliance responds to global address 10.2.2.128 as a network address and to 10.2.2.255 as the broadcast address. Without an existing translation, the adaptive security appliance denies inbound packets destined for 10.2.2.128 or 10.2.2.255, and logs this message.

When the suspected IP address is a host IP address, configure a separate static command with a host mask in front of the subnet static command (the first match rule for static commands). The following static commands cause the adaptive security appliance to respond to 10.2.2.128 as a host address:

static (inside,outside) 10.2.2.128 10.2.2.128 netmask 255.255.255.255 
static (inside,outside) 10.2.2.128 10.2.2.128 netmask 255.255.255.128

The translation may be created by traffic started from the inside host with the IP address in question. Because the adaptive security appliance views a network or broadcast IP address as a host IP address with an overlapped subnet static configuration, the network address translation for both static commands must be the same.

I have NO IDEA what this means but maybe you could provide some insights. NEXT STEPS?

varrao · ‎07-18-2011

Hi Dustin,

I am definitely here , to isolate the issue, I would request you to tell me the following info:

behind whihc interfaces are these two machines in question

you would need to check the captures on the ASA to check if the packets are being dropped by the firewall.

the log tells us that the packet was dropped because there was no relevant translation for it.

so could you provide me the latest running-config from the firewall.

Could you chjeck what translation is being created for the source and the destination on the firewall:

show xlate | in 192.168.1.9

show xlate | in 192.168.1.12

Since it is an intermittent issue, I would suggest you to have a continuous ping initiated and wait for the drop to occur and collect the details.

Thanks,

-Varun

Thanks,
Varun Rao

kidsmed-it · ‎07-18-2011

Varun,

Here is the latest ASA Config.

This is the latest xlate :

show xlate

20 in use, 54 most used

Global 10.1.3.120 Local 192.168.1.7

Global 192.168.1.0 Local 255.255.255.0

PAT Global 70.56.200.30(32688) Local 192.168.1.9(58688)

PAT Global 70.56.200.30(46254) Local 192.168.1.9(58684)

PAT Global 192.168.1.1(186) Local 192.168.1.9(137)

PAT Global 70.56.200.30(10194) Local 192.168.1.9(58648)

PAT Global 70.56.200.30(37728) Local 192.168.1.9(58634)

PAT Global 70.56.200.30(62317) Local 192.168.1.9(58631)

PAT Global 70.56.200.30(24753) Local 192.168.1.9(58627)

PAT Global 70.56.200.30(30360) Local 192.168.1.9(58626)

PAT Global 70.56.200.30(19754) Local 192.168.1.9(58625)

PAT Global 70.56.200.30(80) Local 192.168.1.9(137)

PAT Global 70.56.200.30(11450) Local 192.168.1.9(58611)

PAT Global 70.56.200.30(28166) Local 192.168.1.7(3733)

PAT Global 70.56.200.30(47319) Local 192.168.1.7 ICMP id 512

PAT Global 70.56.200.30(32084) Local 192.168.1.7(3732)

PAT Global 70.56.200.30(3633) Local 192.168.1.7(3731)

PAT Global 70.56.200.30(24362) Local 192.168.1.7(3728)

PAT Global 70.56.200.30(29073) Local 192.168.1.7(3695)

PAT Global 70.56.200.30(371) Local 192.168.1.7(137)

ASA Version 8.2(1)
!
hostname kidsmedasa
domain-name phx.xxxxxx.com
enable password xxxxxxxx encrypted
passwd xxxxxxx encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group pppoex
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 205.171.3.65
name-server 205.171.2.65
domain-name phx.xxxxxxx.com
same-security-traffic permit intra-interface
access-list icmp_ping extended permit icmp any any echo-reply
access-list ICMPACL extended permit icmp any any
access-list emds-nat extended permit ip host 192.168.1.7 192.168.50.0 255.255.255.0
access-list inside_acl extended permit ip 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any eq telnet
access-list inside_acl extended permit ip any any
access-list inside_acl extended permit udp 192.168.1.0 255.255.255.0 any
access-list emds-crypto extended permit ip host 10.1.3.120 192.168.50.0 255.255.255.0
pager lines 24
logging enable
logging monitor debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-621.bin
asdm history enable
arp timeout 14400
global (inside) 10 interface
global (outside) 10 interface
nat (inside) 10 0.0.0.0 0.0.0.0
static (inside,outside) 10.1.3.120 access-list emds-nat
static (inside,inside) 192.168.1.0 255.255.255.0 netmask 255.255.255.0
access-group inside_acl in interface inside
access-group inside_acl out interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address emds-crypto
crypto map outside_map 20 set peer 66.179.80.108
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group pppoex request dialout pppoe
vpdn group pppoex localname xxxxxxxxx@qwest.net
vpdn group pppoex ppp authentication chap
vpdn username xxxxxxx@qwest.net password *********
dhcpd dns 205.171.3.65 205.171.2.65
dhcpd lease 4500
dhcpd domain phx.kidsmed.com
dhcpd auto_config outside
!
dhcpd address 192.168.1.10-192.168.1.137 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.1.9 config-20110710
webvpn
username kidsmed-it password xxxxxxxxx encrypted privilege 15
username admin password xxxxxxxx encrypted privilege 15
username cisco password xxxxxxxxxxx encrypted privilege 15
tunnel-group 66.179.80.108 type ipsec-l2l
tunnel-group 66.179.80.108 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:7cd5d8d9ce88603364924a99b6f9499f
: end

kidsmed-it · ‎07-18-2011

Varun,

I have to get some sleep. It is 11:30pm on the 18th and have put in an 11 hr day already, don't know your time.

I hope you have some ideas. I will try to be back at it tomorrow nite.

Can you give me some idea of what hours you are available?

Thx in advance.

varrao · ‎07-18-2011

You can catch me from 7:00 am to 12 noon and 7:30 pm to 11:00 pm your time, thats the only time that overlaps for us, I work in Uk timezone.

-Varun

Thanks,
Varun Rao

kidsmed-it · ‎07-19-2011

Hey Varun,

I have been sniffing packets with Wireshark, Thru a lot of perseverance, have finally gotten some clear messages to debug. I don't know if you can help but below is a sniffer packet capture . showing issues with SMB or LANMAN protocol , I believe. The IP Address for the DB Server that I am trying to access is 192.168.1.9 and doing it from a WIN XP Pro Client, 192.168.1.11.

If you look at Frames 14 and 15, I think I see where my problem is in regards to being able to logon to the DB Server. There is a packet with a /sql qry and then a STATUS_ACCESS_DENIED. See what you think.

No. Time Source Destination Protocol Info
1 0.000000 192.168.1.11 192.168.1.9 TCP dfoxserver > netbios-ssn [SYN] Seq=0 Win=64512 Len=0 MSS=1460

Frame 1 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 0, Len: 0

No. Time Source Destination Protocol Info
2 0.000340 192.168.1.9 192.168.1.11 TCP netbios-ssn > dfoxserver [SYN, ACK] Seq=0 Ack=1 Win=8192 Len=0 MSS=1460

Frame 2 (62 bytes on wire, 62 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 0, Ack: 1, Len: 0

No. Time Source Destination Protocol Info
3 0.000374 192.168.1.11 192.168.1.9 NBSS Session request, to EMDSERVER01<20> from KIDSMED-MAIN<00>

Frame 3 (126 bytes on wire, 126 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 1, Ack: 1, Len: 72
NetBIOS Session Service

No. Time Source Destination Protocol Info
4 0.000717 192.168.1.9 192.168.1.11 NBSS Positive session response

Frame 4 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 1, Ack: 73, Len: 4
NetBIOS Session Service

No. Time Source Destination Protocol Info
5 0.000794 192.168.1.11 192.168.1.9 SMB Negotiate Protocol Request

Frame 5 (191 bytes on wire, 191 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 73, Ack: 5, Len: 137
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
6 0.002623 192.168.1.9 192.168.1.11 SMB Negotiate Protocol Response

Frame 6 (263 bytes on wire, 263 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 5, Ack: 210, Len: 209
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
7 0.002968 192.168.1.11 192.168.1.9 TCP [TCP segment of a reassembled PDU]

Frame 7 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 210, Ack: 214, Len: 1460

No. Time Source Destination Protocol Info
8 0.002983 192.168.1.11 192.168.1.9 TCP [TCP segment of a reassembled PDU]

Frame 8 (1514 bytes on wire, 1514 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 1670, Ack: 214, Len: 1460

No. Time Source Destination Protocol Info
9 0.002994 192.168.1.11 192.168.1.9 SMB Session Setup AndX Request

Frame 9 (164 bytes on wire, 164 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 3130, Ack: 214, Len: 110
[Reassembled TCP Segments (3030 bytes): #7(1460), #8(1460), #9(110)]
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
10 0.003702 192.168.1.9 192.168.1.11 TCP netbios-ssn > dfoxserver [ACK] Seq=214 Ack=3240 Win=64240 Len=0

Frame 10 (60 bytes on wire, 60 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 214, Ack: 3240, Len: 0

No. Time Source Destination Protocol Info
11 0.004540 192.168.1.9 192.168.1.11 SMB Session Setup AndX Response

Frame 11 (439 bytes on wire, 439 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 214, Ack: 3240, Len: 385
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
12 0.004710 192.168.1.11 192.168.1.9 SMB Tree Connect AndX Request, Path: \\EMDSERVER01\IPC$

Frame 12 (146 bytes on wire, 146 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 3240, Ack: 599, Len: 92
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
13 0.005110 192.168.1.9 192.168.1.11 SMB Tree Connect AndX Response

Frame 13 (114 bytes on wire, 114 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 599, Ack: 3332, Len: 60
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
14 0.005171 192.168.1.11 192.168.1.9 SMB NT Create AndX Request, Path: \sql\query

Frame 14 (164 bytes on wire, 164 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 3332, Ack: 659, Len: 110
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
15 0.005518 192.168.1.9 192.168.1.11 SMB NT Create AndX Response, FID: 0x0000, Error: STATUS_ACCESS_DENIED

Frame 15 (93 bytes on wire, 93 bytes captured)
Ethernet II, Src: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02), Dst: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee)
Internet Protocol, Src: 192.168.1.9 (192.168.1.9), Dst: 192.168.1.11 (192.168.1.11)
Transmission Control Protocol, Src Port: netbios-ssn (139), Dst Port: dfoxserver (2960), Seq: 659, Ack: 3442, Len: 39
NetBIOS Session Service
SMB (Server Message Block Protocol)

No. Time Source Destination Protocol Info
16 0.118990 192.168.1.11 192.168.1.9 TCP dfoxserver > netbios-ssn [ACK] Seq=3442 Ack=698 Win=63815 Len=0

Frame 16 (54 bytes on wire, 54 bytes captured)
Ethernet II, Src: 00:26:b9:79:6e:ee (00:26:b9:79:6e:ee), Dst: 78:2b:cb:25:51:02 (78:2b:cb:25:51:02)
Internet Protocol, Src: 192.168.1.11 (192.168.1.11), Dst: 192.168.1.9 (192.168.1.9)
Transmission Control Protocol, Src Port: dfoxserver (2960), Dst Port: netbios-ssn (139), Seq: 3442, Ack: 698, Len: 0

No. Time Source Destination Protocol Info
17 1.421998 192.168.1.11 192.168.1.9 SMB NT Create AndX Request, Path: \sql\query

kidsmed-it · ‎07-19-2011

Varun,

I hope you are there. We are very close! The ASDM logs yielded the following DENY from the ASA device. I am not sure what the informational message is trying to say.

Dustin

6 Jul 19 2011 21:12:15 106015 192.168.1.9 139 192.168.1.11 3077 Deny TCP (no connection) from 192.168.1.9/139 to 192.168.1.11/3077 flags SYN ACK on interface inside

%ASA-6-106015: Deny TCP (no connection) from IP_address/port to
IP_address/port flags tcp_flags on interface interface_name.

The adaptive security appliance discarded a TCP packet that has no associated connection
in the adaptive security appliance connection table. The adaptive security appliance
looks for a SYN flag in the packet, which indicates a request to establish a new connection.
If the SYN flag is not set, and there is not an existing connection, the adaptive security appliance

discards the packet.

varrao · ‎07-19-2011

Hi Dustin,

Yes these sniffers do suggest it could be an issue. But one morething that we need to verify is, if these sniffer pop up at the same moment you experience a drop in ping, then definitely we know where the issue lies, you can do the same thing, apply captures on the ASA, initiate constant pings, and then match the timestamp of the ping drop with the denied status sniffer.

Thanks,

Varun

Thanks,
Varun Rao

kidsmed-it · ‎07-19-2011

Varun,

I am troubleshooting two issues.

1) The Intermittent Ping blocks and 2) Not being able to logon to the SQL*Server database.

So above packet information was for the SQL*Server Logon problem. Just before that the Pings went thru fine.

Now the Pings are being blocked and I get the following ASDM syslogs.

Jul 19 2011

21:30:48

305006

192.168.1.11

regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

%ASA-3-305006: {outbound static|identity|portmap|regular) translation creation failed for protocol src interface_name:source_address/source_port dst interface_name:dest_address/dest_port

A protocol (UDP, TCP, or ICMP) failed to create a translation through the adaptive security appliance. The adaptive security appliance does not allow packets through that are destined for network or broadcast addresses. The adaptive security appliance provides this checking for addresses that are explicitly identified with static commands. For inbound traffic, the adaptive security appliance denies translations for an IP address identified as a network or broadcast address.

The adaptive security appliance does not apply PAT to all ICMP message types; it only applies PAT ICMP echo and echo-reply packets (types 8 and 0). Specifically, only ICMP echo or echo-reply packets create a PAT translation. As a result, when the other ICMP messages types are dropped, this message is generated.

The adaptive security appliance uses the global IP address and mask from configured static commands to differentiate regular IP addresses from network or broadcast IP addresses. If the global IP address is a valid network address with a matching network mask, then the adaptive security appliance does not create a translation for network or broadcast IP addresses with inbound packets.

For example:

static (inside,outside) 10.2.2.128 10.1.1.128 netmask 255.255.255.128

The adaptive security appliance responds to global address 10.2.2.128 as a network address and to 10.2.2.255 as the broadcast address. Without an existing translation, the adaptive security appliance denies inbound packets destined for 10.2.2.128 or 10.2.2.255, and logs this message.

When the suspected IP address is a host IP address, configure a separate static command with a host mask in front of the subnet static command (the first match rule for static commands). The following static commands cause the adaptive security appliance to respond to 10.2.2.128 as a host address:

static (inside,outside) 10.2.2.128 10.2.2.128 netmask 255.255.255.255 
static (inside,outside) 10.2.2.128 10.2.2.128 netmask 255.255.255.128

The translation may be created by traffic started from the inside host with the IP address in question. Because the adaptive security appliance views a network