Need to understand ASA capture

[aslam.bajwa]

Hello All , 

i have file server ip 10.X.212.X , (Gateway - ASA firewall) , Client IP 10.x.214.X

Client is unable to access shared folder on file server .

Below are the Cap Details :

1049: 12:43:54.487004 802.1Q vlan#301 P0 10.X.214.X.61601 > 10.X.212.X.445: SWE 3945913378:3945913378(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
1070: 12:43:55.576721 802.1Q vlan#301 P0 10.X.214.X.61603 > 10.X.212.X.139: SWE 340660149:340660149(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
1136: 12:43:57.482930 802.1Q vlan#301 P0 10.X.214.X.61601 > 10.X.212.X.445: SWE 3945913378:3945913378(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
1164: 12:43:58.592147 802.1Q vlan#301 P0 10.X.214.X.61603 > 10.X.212.X.139: SWE 340660149:340660149(0) win 8192 <mss 1460,nop,wscale 8,nop,nop,sackOK>
1413: 12:44:03.486013 802.1Q vlan#301 P0 10.X.214.X.61601 > 10.X.212.X.445: S 3945913378:3945913378(0) win 8192 <mss 1460,nop,nop,sackOK>
1443: 12:44:04.595351 802.1Q vlan#301 P0 10.X.214.X.61603 > 10.X.212.X.139: S 340660149:340660149(0) win 8192 <mss 1460,nop,nop,sackOK>
1926: 12:44:16.609724 802.1Q vlan#301 P0 10.X.214.X.137 > 10.X.212.X.137: udp 50
1969: 12:44:18.139809 802.1Q vlan#301 P0 10.X.214.X.137 > 10.X.212.X.137: udp 50
2050: 12:44:19.655437 802.1Q vlan#301 P0 10.X.214.X.137 > 10.X.212.X.137: udp 50

Please help me to understand above , that why client unable to access shared folder on file server.

Regards , 

[GioGonza · Accepted solution]

Hello @aslam.bajwa, 

It seems you don´t have reply from the internal subnet but I would it will be better if you download the capture as a PCAP file in order to look deeper in the information, this is the link for reference: https://www.tunnelsup.com/packet-captures-on-cisco-asa/

HTH

Gio

[aslam.bajwa]

Hi GioGonza ,
thank you for your reply , need one clarification +++internal subnet+++ mean from file server ?

thank you

[mikael.lahtela · Accepted solution]

Hi,

10.X.214.X is sending packets on port 139, 445 but nothing is coming back from 10.X.212.X.

br, Micke

[GioGonza]

Yes from the file server. 

Gio

[Ajay Saini · Accepted solution]

Hello,

If these captures are taken on the interface facing the server, then these are sufficient to prove that ASA can be ruled out. If not, then take captures on the interface facing the server .212 and if it shows packet leaving ASA, then we can focus on next layer3 device.

HTH
AJ