Buy or Renew
Buy or Renew
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
303
Views
0
Helpful
5
Replies

Cisco asa help

markdacoron
Beginner
Beginner

‎05-12-2015 03:16 PM - edited ‎03-11-2019 10:55 PM

I get this message on log

TCP access denied by ACL from 70.xxx.xxx.xxx/3061 to outside:xxx.xxx.xxx.178/443

I am not a cisco person.

Any help will be appreciated.


: Saved
:
ASA Version 8.0(4)
!
hostname ciscoasa
domain-name xxxxx.com
enable password XXXXX encrypted
passwd XXXX encrypted
names
name 10.1.11.25 Apple
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address xxx.xxx.xxx.178 255.255.255.252
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 10.1.11.2 255.255.255.0
!
interface Ethernet0/2
 shutdown
 no nameif
 no security-level

 no ip address
!
interface Ethernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0
 management-only
!
regex domainlist1 "\.youtube\.com"
regex domainlist2 "\.facebook\.com"
boot system disk0:/asa804-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
 name-server 10.1.3.32
 name-server 10.1.3.33
 domain-name xxxx.com
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp 10.1.11.0 255.255.255.0 any
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.7.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.4.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.1.8.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 10.0.0.0 255.0.0.0
access-list inside_access_in extended permit ip 10.1.11.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list nonat extended permit ip 10.1.11.0 255.255.255.0 10.1.3.0 255.255.255.0
access-list nonat extended permit ip 10.1.3.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.1.7.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list nonat extended permit ip 10.1.7.0 255.255.255.0 10.1.4.0 255.255.255.0
access-list nonat extended permit ip 10.1.2.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list nonat extended permit ip 10.1.8.0 255.255.255.0 10.1.8.0 255.255.255.0
access-list nonat extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0
access-list nonat extended permit ip 192.168.10.0 255.255.255.0 10.1.2.0 255.255.255.0
access-list inside_mpc extended permit tcp any any eq www
access-list inside_mpc extended permit tcp any any eq 8080
access-list outside_access_in extended permit icmp any any inactive
pager lines 24
logging enable

logging buffered informational
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
failover timeout -1
icmp unreachable rate-limit 1 burst-size 1
icmp permit any inside
asdm image disk0:/asdm-712.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp xxx.xxx.xxx.178 https Apple https netmask 255.255.255.255
static (inside,inside) 192.168.10.0 192.168.10.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.11.0 10.1.11.0 netmask 255.255.255.0
static (inside,inside) 10.1.3.0 10.1.3.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.7.0 10.1.7.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.4.0 10.1.4.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.2.0 10.1.2.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.1.8.0 10.1.8.0 netmask 255.255.255.0 norandomseq nailed
static (inside,inside) 10.0.0.0 10.0.0.0 netmask 255.0.0.0 norandomseq nailed
static (inside,outside) xxx.xxx.xxx.178 Apple netmask 255.255.255.255 dns
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 67.52.149.177 1
route inside 10.0.0.0 255.0.0.0 10.1.11.1 1
route inside 10.1.2.0 255.255.255.0 10.1.11.1 1
route inside 10.1.3.0 255.255.255.0 10.1.11.1 1
route inside 10.1.4.0 255.255.255.0 10.1.11.1 1
route inside 10.1.7.0 255.255.255.0 10.1.11.1 1
route inside 10.1.8.0 255.255.255.0 10.1.11.1 1
route inside 192.168.10.0 255.255.255.0 10.1.11.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.1.11.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 management
ssh timeout 5
console timeout 0
dhcpd dns 10.1.3.32 10.1.3.33
dhcpd domain xxxxx.com
dhcpd auto_config inside
!
dhcpd dns 10.1.3.32 10.1.3.33 interface inside
!
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
username cisco password 3USUcOPFUiMCO4Jk encrypted
!
class-map type regex match-any DomainBlockList
 match regex domainlist1
 match regex domainlist2
class-map type inspect http match-all BlockDomainsClass
match request header host regex class DomainBlockList
class-map inspection_default
 match default-inspection-traffic
class-map type inspect http match-all AppHeaderClass
class-map httptraffic
 match access-list inside_mpc
class-map type inspect http match-all BlockURLsClass
!
!
policy-map type inspect http http_inspection_policy_blockdomains
 parameters
  protocol-violation action drop-connection
 class AppHeaderClass
  drop-connection log
 match request method connect
  drop-connection log
 class BlockDomainsClass
  reset log
 class BlockURLsClass
  reset log
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect icmp
 class httptraffic
  inspect http http_inspection_policy_blockdomains
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:b489c2480654120d513d7cb907a92c82
: end

 

- See more at: https://supportforums.cisco.com/discussion/12505581/help-needed-cisco-asa-5505-website-https-access#sthash.y76HHrgt.dpuf

Labels:
0 Helpful
5 Replies 5

Pavel Trinos
Beginner
Beginner

‎05-13-2015 05:36 AM

Your access-list outside_access_in is missing a line to allow your access on HTTPS port to your Apple device.

Try this:

 

access-list outside_aceess_in extended permit tcp any xxx.xxx.xxx.178 255.255.255.255 eq 443

 

0 Helpful

markdacoron
Beginner
Beginner
In response to Pavel Trinos

‎05-13-2015 06:53 AM

I tried that but still no luck.

0 Helpful

Vibhor Amrodia
Cisco Employee
Cisco Employee
In response to markdacoron

‎05-13-2015 09:23 PM

Hi,

With the above ACL in place , can you provide the output of this packet trace:-

packet input outside tcp 4.2.2.2 2345 xxx.xxx.xxx.178 443 det

Thanks and Regards,

Vibhor Amrodia

0 Helpful

markdacoron
Beginner
Beginner
In response to Vibhor Amrodia

‎05-14-2015 09:36 AM

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   xxx.xxx.xxx.178   255.255.255.255 identity

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xd56a0d20, priority=0, domain=permit, deny=true
        hits=5517604, user_data=0x9, cs_id=0x0, flags=0x1000, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

 

0 Helpful

markdacoron
Beginner
Beginner
In response to markdacoron

‎05-15-2015 07:15 AM

Looks like this line of code fixed the issue.

 

static (inside,outside) tcp interface https Apple https netmask 255.255.255.255

0 Helpful
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers
Spotlight Award Nomination
Customers Also Viewed These Support Documents