CISCO ASA 5525

[ddesai]

How will I verify that which policy is currently active for incoming traffic received from Dmz ?

I will need to move internal traffic which is coming from Dmz to another firewall.

Please advice 

[MHM Cisco World · Accepted solution]

best way is using packet tracer 

see traffic which ACL hitting.

[ddesai]

in Packet tracer which port mention as source  port  ? 

destination port details i found from policy

[ddesai]

Thanks for the update.

Can we check with heat count?

Can we check from any logs ?

Do I need to download packet tracert or is it inbuild in cisco ASA

 I never use CISCO ASA so please guide me step by step that will be great help.

few applications pending to move from cisco ASA to new firewall so I am looking for which application still running in CISCO ASA

[MHM Cisco World]

https://community.cisco.com/t5/security-knowledge-base/troubleshooting-access-problems-using-packet-tracer/ta-p/3114976

[Marius Gunnerud · Accepted solution]

you can see which rules are being hit in the access-list using either ASDM where you will see the hit count on the right of each rule, or using show access-list <access-list name> which will also show you a hit count for each rule.

[ddesai]

Can i get heat count latest date and time stamp to know when policy used last date and time?

[ddesai]

How i can find out interal traffic to DMZ policy details from cisco asa 5525 ?>

[MHM Cisco World]

again use packet tracer, 
packet tracer input DMZ <subet in DMZ you want to check><subet in INside or OUTside> detail 
this will give you exactly 
1- NATing using 
2- ACL using (INbound and OUTbound)

[ddesai]

Thanks, and appreciated your update but when i open packet tracer in firewall policy i could not find source port details rest of things i can find out so what port mention as a source port.

[MHM Cisco World]

You can use as port 

12345 <<- randomly port number 

Or 

Specific port number  if you want to check server.

For example 

Packet tracer input DMZ tcp 1.1.1.1 80 2.2.2.2 12345 

Or 

Packet tracer input OUTside tcp 2.2.2.2 12345 1.1.1.1 80

[ddesai]

If I am adding source port as a random than it give me error.

Can I add for all in pakcet tracer souce port 80 or https ?

Destination port I have mentioned as per Cisco policy.

[Aref Alsouqi]

When you run packet tracer you should have the traffic flow that you want to test in mind. You can put any port in the source or in the destination, but those ports should match the traffic flow that you are trying to simulate.

[Marius Gunnerud · Accepted solution]

You will not get a time and date on the hitcount unfortunately. So what you could do is clear the counter and let it run a week or two to get an indication of what is being used.

To see which access-list is being used for which interface, if that is what you mean, you can issue the show running-config access-group which will give you the access-list name and the interface it is associated with

ASAt# show running-config access-group
access-group <access-list> in interface <interface name>

[ddesai · Accepted solution]

Thanks, and appreciated your answer, 

which option will clear heat counter?