cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1647
Views
0
Helpful
2
Replies

How to find the ingress interface for traffic

mors105
Level 1
Level 1

Hi, I have a few ASA's configured with multiple interfaces and multiple sub-interfaces. With many different subnets behind these interfaces.

Is there any easy way from the command line to work out which interface from a specific IP is coming in on. e.g say I have a host behind interface gi1/0.200 and it's pinging the sub-interface address x.x.x.x of gi1/0.200 - How do I know if I just do a debug icmp trace etc? I can see traffic coming in, but not on what interface.

On occasion I inherit a firewall without a topology diagram and have a nightmare finding out what traffic is coming in what interface. This is no good to me if I've got 20 interfaces and 50 subnets behind them.

1 Accepted Solution

Accepted Solutions

Jouni Forss
VIP Alumni
VIP Alumni

Hi,

The ASA doesnt really have that many routing related commands as some Cisco IOS devices.

I don't know really if there is any other way to determine the current setup other than checking the routing table.

The following command will show the current routing table

show route

The following command will show the currently configured static routes

show run route

If you want a brief information about the actual interfaces and their IP addresses you can use the following

show ip address

The following also shows similiar information but not for example the subnet mask of the interface

show interface ip brief

If you are referring to seeing what traffic is going through the firewall and where its originated from then you should have the "logging" level set to "informational". This will by default show you log messages related to connection and translation forming. Naturally you have to configure this for the location where you are viewing the logs

For example

  • buffered = Device log buffer
  • trap = Syslog server
  • asdm = The ASDM Monitoring sections logging window

Naturally you can also see the source and destination interface in the connection table

show conn

show conn long

I don't think the ASA really has any other way to show you how the network is built. You just have to refer to the actual configuration and routing table.

- Jouni

View solution in original post

2 Replies 2

Jouni Forss
VIP Alumni
VIP Alumni

Hi,

The ASA doesnt really have that many routing related commands as some Cisco IOS devices.

I don't know really if there is any other way to determine the current setup other than checking the routing table.

The following command will show the current routing table

show route

The following command will show the currently configured static routes

show run route

If you want a brief information about the actual interfaces and their IP addresses you can use the following

show ip address

The following also shows similiar information but not for example the subnet mask of the interface

show interface ip brief

If you are referring to seeing what traffic is going through the firewall and where its originated from then you should have the "logging" level set to "informational". This will by default show you log messages related to connection and translation forming. Naturally you have to configure this for the location where you are viewing the logs

For example

  • buffered = Device log buffer
  • trap = Syslog server
  • asdm = The ASDM Monitoring sections logging window

Naturally you can also see the source and destination interface in the connection table

show conn

show conn long

I don't think the ASA really has any other way to show you how the network is built. You just have to refer to the actual configuration and routing table.

- Jouni

Thanks Jouni

Review Cisco Networking for a $25 gift card