How to determine if ASA is blocking Traffic or not?

[mahesh18]

Hi everyone,

i am supporting ASA  in client office.I am new to ASA  world.

Users mostly ask for to check if ASA is allowing specfic port or not.

I do not know how can i check that.

Is there any way that i can determine if ASA  is blocking port or not?

If ASA is blocking port what steps i need to take to allow the ASA  to allow the specif port?

regards

mahesh

[Muhammad Thanveer · Accepted solution]

This is very simple,

Do telnet example

go to command prompt

telnet destination ip addresss port no

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."

[Muhammad Thanveer · Accepted solution]

Dear Mahesh,

Some times port for the server may not be enabled on the server it self, in that scenario you will not be able to do telnet from the source, hence you should first do telnet from the same server segment ip series, because there may be no firewall in the same server segment, if you are able to do telnet from same server segment ip then server side is ok .

Now if you are able to do telnet from source machine, then port is ok from server side and asa is allowing the traffic.

If you are doing from the client machine and you are uinable to do telnet then asa is not allowing  the traffic and there is no issue from server side.

If you are not able to do telnet from same server ip series itself then port is not enabled on server itself.

Plese rate if information provided is helpful.

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."

[mahesh18]

Hi Thannveer,

Many thanks for reply.

Regards

Mahesh

[Julio Carvajal · Accepted solution]

Hello Mahesh,

Run an scan using Nmap or any other scanning tool,

If the port is being blocked just create the proper ACL changes to make it work , nat might be required as well.

Any other question..Sure..Just remember to rate all of the helpful posts

Julio

[mathieupoussin · Accepted solution]

Use the packet-tracer command on the firewall, like this :

packet-tracer input scr-inside tcp 192.168.3.67 9999 8.8.8.8 80

(scr-inside = input interface) then source ip/port and destination ip/port

[Muhammad Thanveer]

nice command Mathieu.

Regards
Thanveer
"Everybody is genius. But if you judge a fish by its ability to climb a tree, it will live its whole life believing that it is a stupid."