Hello,
I just replaced a PIX firewall with Cisco ASA firewall and for some reason, one part of the access is not working which was working on PIX firewall. Access to dmz8 from outside (internet) is not working for a public IP network on dmz8. I also see that are many drops on the interface outside, but I am not sure what is causing these drops. When i try to reach public ip on dmz8 (changed to 10.10.126.x for security purposes) and do a capture on outside interface, I dont even see packets in the capture on asa. I think ASA is dropping the packets before they get captured in the capture. Can someone help me resolve this issue? I have changed the DMZ8 public network in the below config to 10.10.126.16/28. And I am trying to reach 10.10.126.28 from outside.
Also I can reach 10.10.126.28 from the PIX and the Internet gateway. Relevant configuration is listed below.
I also did a packet-tracer for going from dmz8 to outside and as shown below and it says its an acl-drop. But I am not sure what acl is dropping it. Please see packet tracer output below.
interface GigabitEthernet0/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/0.398
vlan 398
nameif outside
security-level 0
ip address 10.10.126.9 255.255.255.240 standby 10.10.126.10
!
interface GigabitEthernet0/2.315
vlan 315
nameif dmz8
security-level 80
ip address 10.10.126.25 255.255.255.240 standby 10.10.126.26
!
access-list out extended permit icmp any any echo-reply
access-list out extended permit icmp any any unreachable
access-list out extended permit icmp any any time-exceeded
access-list out extended permit udp any any eq isakmp
access-list out extended permit esp any any
access-list out extended permit icmp any 10.10.126.16 255.255.255.240
access-list dmz8 extended permit icmp any 10.0.0.0 255.0.0.0
access-list dmz8 extended permit icmp any 10.0.0.0 255.0.0.0 time-exceeded
access-list dmz8 extended permit icmp any 10.0.0.0 255.0.0.0 unreachable
access-list dmz8 extended deny tcp any any eq 135
access-list dmz8 extended deny tcp any any eq 445
access-list dmz8 extended deny tcp any any eq 6667
access-list dmz8 extended permit icmp any any
access-list dmz8 extended permit ip any any
access-list nonat_dmz8 extended permit ip 10.128.0.16 255.255.255.248 10.255.1.0 255.255.255.0
global (outside) 1 10.10.126.11
global (dmz8) 1 10.10.126.24
nat (dmz8) 0 access-list nonat_dmz8
nat (dmz8) 1 10.103.15.0 255.255.255.0
nat (dmz8) 2 10.103.33.0 255.255.255.0
nat (dmz8) 2 10.192.0.0 255.255.254.0
nat (dmz8) 2 10.128.0.0 255.224.0.0
nat (dmz8) 2 10.224.0.0 255.224.0.0
static (dmz8,outside) 10.10.126.16 10.10.126.16 netmask 255.255.255.240
access-group out in interface outside
access-group dmz8 in interface dmz8
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect http
inspect ils
inspect icmp
inspect icmp error
!
service-policy global_policy global
Interface GigabitEthernet0/0.398 "outside", is up, line protocol is up
Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
VLAN identifier 398
MAC address 1cdf.0f2e.e05a, MTU 1500
IP address 10.10.126.9, subnet mask 255.255.255.240
Traffic Statistics for "outside":
982354 packets input, 381201545 bytes
1258846 packets output, 608512096 bytes
109542 packets dropped
SPA-ASA# packet-tracer input outside icmp 10.10.126.28 8 0 10.10.126.1
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 3
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow
Phase: 4
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 63.110.126.0 255.255.255.240 outside
Phase: 5
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
Thank you!
