06-20-2018 01:14 AM - edited 02-21-2020 07:54 AM
I can see a connection using "show local-host" and "show conn", however, I cannot trace it back to the (Identity firewall) ACE that was used to allow that connection. Is there a way?
Each ACE (shown using "show access-list") owns a unique hash code, so, I was expecting "show local-host" and "show conn" to reference such, but it doesn't seem to.
On ASA 9.6(1).
06-20-2018 01:44 AM
The hash is used to find the corresponding entries in the syslog. You can trace the ACE with packet-tracer:
packet-tracer input inside tcp user THE-USER 1234 1.2.3.4 443
This gives you the ASA-processing including ACE for the user to the server 1.2.3.4/443.
06-20-2018 01:55 AM
06-20-2018 01:58 AM
it doesn't know that. Packet-tracer always uses the last mapping. I assume in that case packet-tracer will not of much help.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide