Hello, jcarvaja!
Excellent, now i see the problem, it worked perfectly!
PERIMETRAL# packet-tracer input vpn-inside tcp 10.32.67.31 1026 10.1.76.40 205$
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7ab427a8, priority=12, domain=capture, deny=false
hits=14887767, user_data=0x7b477a28, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x75bba118, priority=1, domain=permit, deny=false
hits=80974662, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
Phase: 3
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow
Phase: 4
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
static (dmz6-tmp,vpn-inside) 10.1.76.40 10.1.74.127 netmask 255.255.255.255 dns tcp 300 100
nat-control
match ip dmz6-tmp host 10.1.74.127 vpn-inside any
static translation to 10.1.76.40
translate_hits = 0, untranslate_hits = 6298
Additional Information:
NAT divert to egress interface dmz6-tmp
Untranslate 10.1.76.40/0 to 10.1.74.127/0 using netmask 255.255.255.255
Phase: 5
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 10.32.67.0 255.255.255.0 vpn-inside
Phase: 6
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group vpn-inside-inbound in interface vpn-inside
access-list vpn-inside-inbound extended permit tcp 10.32.67.0 255.255.255.0 host 10.1.76.40
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7c37d2e0, priority=12, domain=permit, deny=false
hits=67, user_data=0x771701c0, cs_id=0x0, flags=0x0, protocol=6
src ip=10.32.67.0, mask=255.255.255.0, port=0
dst ip=10.1.76.40, mask=255.255.255.255, port=0, dscp=0x0
Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x75bbcd90, priority=0, domain=permit-ip-option, deny=true
hits=8741820, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 8
Type: INSPECT
Subtype: inspect-ftp
Result: ALLOW
Config:
class-map class_ftp
match port tcp eq 20573
policy-map global_policy
class class_ftp
inspect ftp
service-policy global_policy global
Additional Information:
Forward Flow based lookup yields rule:
in id=0x77ddbe48, priority=70, domain=inspect-ftp, deny=false
hits=1481, user_data=0x77ddb7e8, cs_id=0x0, use_real_addr, flags=0x0, protocol=6
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=20573, dscp=0x0
Phase: 9
Type: NAT-EXEMPT
Subtype: rpf-check
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7625e4e8, priority=6, domain=nat-exempt-reverse, deny=true
hits=2, user_data=0x7afebdd0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=10.1.74.127, mask=255.255.255.255, port=0, dscp=0x0
Phase: 10
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (vpn-inside) 0 0.0.0.0 0.0.0.0
nat-control
match ip vpn-inside any outside any
no translation group, implicit deny
policy_hits = 1
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7a734a78, priority=0, domain=host, deny=false
hits=897389, user_data=0x7b5d6590, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 11
Type: IDS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
out id=0x77de16b0, priority=51, domain=ids, deny=false
hits=371867171, user_data=0x77de1088, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 12
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
static (dmz6-tmp,vpn-inside) 10.1.76.40 10.1.74.127 netmask 255.255.255.255 dns tcp 300 100
nat-control
match ip dmz6-tmp host 10.1.74.127 vpn-inside any
static translation to 10.1.76.40
translate_hits = 0, untranslate_hits = 6298
Additional Information:
Forward Flow based lookup yields rule:
out id=0x76cf9e00, priority=5, domain=nat-reverse, deny=false
hits=8099, user_data=0x76cf9968, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=10.1.74.127, mask=255.255.255.255, port=0, dscp=0x0
Phase: 13
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (dmz6-tmp,dmz4) tcp 10.1.76.40 20573 10.1.74.127 20573 netmask 255.255.255.255 dns tcp 300 100
nat-control
match tcp dmz6-tmp host 10.1.74.127 eq 20573 dmz4 any
static translation to 10.1.76.40/20573
translate_hits = 0, untranslate_hits = 23407
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x76a83560, priority=5, domain=host, deny=false
hits=287201, user_data=0x76a82f20, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=10.1.74.127, mask=255.255.255.255, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 14
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in id=0x75c84ed0, priority=0, domain=permit-ip-option, deny=true
hits=659454008, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0
Phase: 15
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1505857570, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_punt
snp_fp_translate
snp_fp_divert_fragment
snp_ids
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_punt
snp_fp_divert_fragment
snp_ids
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat
Result:
input-interface: vpn-inside
input-status: up
input-line-status: up
output-interface: vpn-inside
output-status: up
output-line-status: up
Action: allow
Regards
