Hi,
I have setup a home lab and I am unable to ping the inside address of my ASAv from the connection core switch. I think it is being blocked by the implicit rule but my attempts to add the correct ACL is not working..
Switch#show ip int brief
Vlan500 10.1.1.3 YES NVRAM up up
interface Vlan500
ip address 10.1.1.3 255.255.255.0
interface GigabitEthernet0/0
description ACCESS > CORE
switchport trunk encapsulation dot1q
switchport mode trunk
media-type rj45
negotiation auto
end
GigabitEthernet0/0 is up, line protocol is up (connected)
Hardware is iGbE, address is 0cba.ac0a.0000 (bia 0cba.ac0a.0000)
Description: ACCESS > CORE
MTU 1500 bytes, BW 1000000 Kbit/sec, DLY 10 usec,
reliability 255/255, txload 1/255, rxload 1/255
Encapsulation ARPA, loopback not set
Keepalive set (10 sec)
Auto Duplex, Auto Speed, link type is auto, media type is unknown media type
output flow-control is unsupported, input flow-control is unsupported
Full-duplex, Auto-speed, link type is auto, media type is RJ45
input flow-control is off, output flow-control is unsupported
ARP type: ARPA, ARP Timeout 04:00:00
Last input 00:00:00, output 00:00:08, output hang never
Last clearing of "show interface" counters never
Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0
Queueing strategy: fifo
Output queue: 0/0 (size/max)
5 minute input rate 1000 bits/sec, 2 packets/sec
5 minute output rate 0 bits/sec, 0 packets/sec
23167 packets input, 1538396 bytes, 0 no buffer
Received 23157 broadcasts (23157 multicasts)
0 runts, 0 giants, 0 throttles
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored
0 watchdog, 23157 multicast, 0 pause input
422 packets output, 69915 bytes, 0 underruns
0 output errors, 0 collisions, 2 interface resets
0 unknown protocol drops
0 babbles, 0 late collision, 0 deferred
0 lost carrier, 0 no carrier, 0 pause output
0 output buffer failures, 0 output buffers swapped out
Switch#
-----------------------------------------------------------------------
ciscoasa# show ip
GigabitEthernet0/1 INSIDE 10.1.1.1 255.255.255.0 CONFIG
interface GigabitEthernet0/1
nameif INSIDE
security-level 100
ip address 10.1.1.1 255.255.255.0
ciscoasa# packet-tracer input INSIDE icmp 10.1.1.1 1 8 10.1.1.2 detailed
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fc20d4b4970, priority=13, domain=capture, deny=false
hits=19, user_data=0x7fc20d4916c0, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
input_ifc=INSIDE, output_ifc=any
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fc20d5fe610, priority=1, domain=permit, deny=false
hits=9, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=INSIDE, output_ifc=any
Phase: 3
Type: ROUTE-LOOKUP
Subtype: No ECMP load balancing
Result: ALLOW
Config:
Additional Information:
Destination is locally connected. No ECMP load balancing.
Found next-hop 10.1.1.2 using egress ifc INSIDE
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fc20d2b6190, priority=501, domain=permit, deny=true
hits=10, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=10.1.1.1, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0, nsg_id=none
input_ifc=INSIDE, output_ifc=any
Result:
input-interface: INSIDE
input-status: up
input-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule, Drop-location: frame 0x0000555c6a55cae6 flow (NA)/NA
What is recommended ACL to allow this traffic?
