ASA is dropping packets between two internal hosts - Page 2

kidsmed-it · ‎07-17-2011

I am a newbie to configuring a router and am setting one up for a small business that uses a client-server application against a SQL Server 2008 database. The router connectivity is working fine getting out to the Internet. An IPSEC VPN Tunnel has been built and working fine. It is the internal client to server access that's causing my headaches.

My problem is that I am not able to logon to the Server Database from my client workstations which are all part of a Windows 2008 Domain.

Connectivity is fine, I am able to ping between ASA and clients and DB server. The std ports 1433, 1434 used by Microsft Sql Services are listening.

From the ASDM, by running packet trace, any packets between the two servers are being dropped, even though I am able to ping, telnet all servers involved. The latest error messages show 'No Matching Global'.

Any help would be greatly appreciated and needed GREATLY.

MY ASA config is such:

ASA Version 8.2(1)
!
hostname xxxxxasa
domain-name phx.xxxxx.com
enable password xxxxxxxxxx encrypted
passwd xxxxxxx encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group pppoex
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 205.171.3.65
name-server 205.171.2.65
domain-name phx.xxxxxxx.com
same-security-traffic permit intra-interface
access-list icmp_ping extended permit icmp any any echo-reply
access-list ICMPACL extended permit icmp any any
access-list emds-nat extended permit ip host 192.168.1.7 192.168.50.0 255.255.255.0
access-list inside_acl extended permit ip 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any
access-list inside_acl extended permit tcp 192.168.1.0 255.255.255.0 any eq telnet
access-list inside_acl extended permit ip any any
access-list emds-crypto extended permit ip host 10.1.3.120 192.168.50.0 255.255.255.0
pager lines 24
logging enable
logging monitor debugging
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-621.bin
asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 192.168.1.0 255.255.255.0
static (inside,outside) 10.1.3.120 access-list emds-nat
access-group inside_acl in interface inside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.1.0 255.255.255.0 outside
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-aes-256 esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 20 match address emds-crypto
crypto map outside_map 20 set peer xxx.xxx.xxx.xxx
crypto map outside_map 20 set transform-set ESP-3DES-SHA
crypto map outside_map 20 set security-association lifetime seconds 28800
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 1
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
management-access inside
vpdn group pppoex request dialout pppoe
vpdn group pppoex localname xxxxxxxx@qwest.net
vpdn group pppoex ppp authentication chap
vpdn username xxxxxxxx@qwest.net password *********
dhcpd dns 205.171.3.65 205.171.2.65
dhcpd lease 4500
dhcpd domain phx.xxxxxx.com
dhcpd auto_config outside
!
dhcpd address 192.168.1.10-192.168.1.137 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tftp-server inside 192.168.1.9 config-20110710
webvpn
username xxxxxx-it password xxxxxxxxxxx encrypted privilege 15
username admin password xxxxxxxxxx encrypted privilege 15
username cisco password xxxxxxxxxx encrypted privilege 15
tunnel-group 66.999.99.999 type ipsec-l2l
tunnel-group 66.999.99.999 ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:404416f0d532bfe08e01c59a29252c31
: end

My latest Packet trace:

kidsmedasa(config)# packet-tracer input inside udp 192.168.1.7 1434 192.168.1.$

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.1.0 255.255.255.0 inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_acl in interface inside
access-list inside_acl extended permit ip 192.168.1.0 255.255.255.0 any
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc9ca1578, priority=12, domain=permit, deny=false
        hits=14308, user_data=0xc78c7170, cs_id=0x0, flags=0x0, protocol=0
        src ip=192.168.1.0, mask=255.255.255.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc957b5c8, priority=0, domain=permit-ip-option, deny=true
        hits=30455, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,outside) 10.1.3.120 access-list emds-nat
match ip inside host 192.168.1.7 outside 192.168.50.0 255.255.255.0
    static translation to 10.1.3.120
    translate_hits = 16, untranslate_hits = 0
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc95ea260, priority=5, domain=host, deny=false
        hits=10423, user_data=0xca0dc768, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip=192.168.1.7, mask=255.255.255.255, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Phase: 6
Type: NAT
Subtype:
Result: DROP
Config:
nat (inside) 10 0.0.0.0 0.0.0.0
match ip inside any inside any
    dynamic translation to pool 10 (No matching global)
    translate_hits = 4, untranslate_hits = 0
Additional Information:
Forward Flow based lookup yields rule:
in id=0xc95dff60, priority=1, domain=nat, deny=false
        hits=3, user_data=0xc95de600, cs_id=0x0, flags=0x0, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

kidsmed-it · ‎07-19-2011

Varun,

I think my traffic is bein redirected. Here are th ASDM logs for the only thing happenning is the Blocked Pings. We are a very small shop.

I am seeing traffic where it apears we are trying to handshake with an outside 174.137.125.35 IP Address and don't know why. Our static Global IP is 70.56.188.207.

Dustin

3|Jul 19 2011|21:53:37|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

6|Jul 19 2011|21:53:36|302014|174.137.125.35|445|192.168.1.9|51184|Teardown TCP connection 40123 for outside:174.137.125.35/445 to inside:192.168.1.9/51184 duration 0:00:00 bytes 0 TCP Reset-O

6|Jul 19 2011|21:53:36|302013|174.137.125.35|445|192.168.1.9|51184|Built outbound TCP connection 40123 for outside:174.137.125.35/445 (174.137.125.35/445) to inside:192.168.1.9/51184 (70.56.188.207/42240)

6|Jul 19 2011|21:53:36|302013|192.168.1.9|51185|255.255.255.11|139|Built inbound TCP connection 40122 for inside:192.168.1.9/51185 (192.168.1.1/47690) to inside:255.255.255.11/139 (192.168.1.11/139)

6|Jul 19 2011|21:53:36|305011|192.168.1.9|51185|192.168.1.1|47690|Built dynamic TCP translation from inside:192.168.1.9/51185 to inside:192.168.1.1/47690

6|Jul 19 2011|21:53:35|302014|174.137.125.35|445|192.168.1.9|51184|Teardown TCP connection 40121 for outside:174.137.125.35/445 to inside:192.168.1.9/51184 duration 0:00:00 bytes 0 TCP Reset-O

6|Jul 19 2011|21:53:35|302013|174.137.125.35|445|192.168.1.9|51184|Built outbound TCP connection 40121 for outside:174.137.125.35/445 (174.137.125.35/445) to inside:192.168.1.9/51184 (70.56.188.207/42240)

6|Jul 19 2011|21:53:35|302014|174.137.125.35|445|192.168.1.9|51184|Teardown TCP connection 40120 for outside:174.137.125.35/445 to inside:192.168.1.9/51184 duration 0:00:00 bytes 0 TCP Reset-O

6|Jul 19 2011|21:53:35|302013|174.137.125.35|445|192.168.1.9|51184|Built outbound TCP connection 40120 for outside:174.137.125.35/445 (174.137.125.35/445) to inside:192.168.1.9/51184 (70.56.188.207/42240)

6|Jul 19 2011|21:53:35|305011|192.168.1.9|51184|70.56.188.207|42240|Built dynamic TCP translation from inside:192.168.1.9/51184 to outside:70.56.188.207/42240

3|Jul 19 2011|21:53:32|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

3|Jul 19 2011|21:53:26|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

6|Jul 19 2011|21:53:23|305012|192.168.1.9|51178|192.168.1.1|5753|Teardown dynamic TCP translation from inside:192.168.1.9/51178 to inside:192.168.1.1/5753 duration 0:01:00

3|Jul 19 2011|21:53:21|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

3|Jul 19 2011|21:53:15|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

6|Jul 19 2011|21:53:14|302014|192.168.1.9|51182|255.255.255.11|139|Teardown TCP connection 40078 for inside:192.168.1.9/51182 to inside:255.255.255.11/139 duration 0:00:30 bytes 0 SYN Timeout

3|Jul 19 2011|21:53:10|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

6|Jul 19 2011|21:53:06|305012|192.168.1.9|51172|70.56.188.207|42244|Teardown dynamic TCP translation from inside:192.168.1.9/51172 to outside:70.56.188.207/42244 duration 0:02:00

3|Jul 19 2011|21:53:37|305006|192.168.1.11||||regular translation creation failed for icmp src inside:192.168.1.9 dst inside:192.168.1.11 (type 0, code 0)

6|Jul 19 2011|21:53:36|302014|174.137.125.35|445|192.168.1.9|51184|Teardown TCP connection 40123 for outside:174.137.125.35/445 to inside:192.168.1.9/51184 duration 0:00:00 bytes 0 TCP Reset-O

6|Jul 19 2011|21:53:36|302013|174.137.125.35|445|192.168.1.9|51184|Built outbound TCP connection 40123 for outside:174.137.125.35/445 (174.137.125.35/445) to inside:192.168.1.9/51184 (70.56.188.207/42240)