Firewall Logging on ASA 5520

[miguel.desantiago]

Hello Cisco Support Community,

I have an ASA 5520 in my company which does all our NAT and Firewall access control.  Currently there is a rule in place to allow an incomming connection on port 2222 from a specific ip address to allow access to a web app our developers created.  This is a test before the web app is released live.  Now the web app can communicate with the specific address and port but the incomming connection on port 2222 isn't getting through.  Everything looks great in the firewall but how can I log any hits this ACL takes to identify any potential problems?

Thank!!

[Julio Carvajal · Accepted solution]

Hello Miguel,

Just add the keyword log at the end of the ACL, that should do  it ( It will generate a log for each hit)

Now the easiest way. You have already an ACL on the outside interface ( let's say is called outside_in)

So just do a show access-list outside_in  and look for the entry that you have configured to allow access on port 2222. Then check if the hit-count is incrementing   ( You can always clear the access-list counters with the command :

clear access-list outside_in counters)

Regards,

Remember to rate all of the helpful posts!!

Julio

[hobbe]

Hi

I am a littlebit unsure what you have working. you state that the webapp can communicate but then you state that 2222 is not getting through..

I would take a look att the command Packet-tracer.

With this command you can test what the firewall will do with a packet ibound on that port.

it will let you know if there is a problem with the configuration.

Good luck

HTH