CISCO ASA 5525

[ddesai]

How will I verify that which policy is currently active for incoming traffic received from Dmz ?

I will need to move internal traffic which is coming from Dmz to another firewall.

Please advice 

[Aref Alsouqi · Accepted solution]

You can use the command "clear access-list < the access list name > counters".

[ddesai]

Please remember to select a correct answer and rate helpful posts - for sure will do Thanks for reminding me appreciated. 

[Aref Alsouqi · Accepted solution]

DMZ interfaces are usually set at 50 security level, but they could be with any security level between 0 and 100. If you do "sh nameif" you should see the interfaces names as well as their security levels. From there take the interfaces names that are configured with a security level between 0 and 100 and run some packet capture on them while you are generating some traffic and check if you get any output. You can run packet capture with the command "cap < name > interface < the interface name > match ip host < source IP > host < destination IP >. Regarding the ACL hits, they won't give any details about the date/time, if you want to get those details you would need to add "log" keyword at the end of the interested ACL entries and then look at the firewall logs, but it is not recommended as it would consume more resources on the device.

[ddesai]

In Cisco ASA ASDM login while I am taking backup manually it was asking for key what is key about ?

[Aref Alsouqi]

Could you please share that screen? I think that key is the protection key that you would use in case you need to restore the config from that backup file.

[Marius Gunnerud · Accepted solution]

To clear the hit count in ASDM just right click the "Clear Hits" button in the toolbar above the search field.  Or you can right click the specific rule you want to clear hits for and select "Clear Hits"

As for packet tracer, as mentioned by others here, you need to know what traffic you are trying to test and which interface this traffic will enter the ASA on from the source perspective.  Usually the source port will be a random high port (I normally use port 12345) but you could actually use any port low or high as source.