cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

127
Views
0
Helpful
1
Replies
jacob6000
Beginner

ZBFW troubleshooting help needed....

All,

 

I need some help troubleshooting a connectivity issue. Everything works fine except for this one device.

 

1) If I see a NAT entry for a specific ip address (1921.68.1.17) when I run "sh ip nat translations", does that mean the fw allowed it and it went to the destination? ie:  passed through the firewall

sh ip nat translations inc 192.168.1.17
udp 96.229.67.41:3060  192.168.1.17:3060 66.222.222.222:3011 66.222.222.222:3011

 

2) How can I log drops ONLY for a specific ip address  (192.168.1.17)?

 

The application needs to speak outbound only on port 3011 and I believe my outbound config allows everything.

class-map type inspect match-any IN-TO-OUT-ALLOW-ALL-CLASS
 match protocol tcp
 match protocol udp
 match protocol icmp
 

policy-map type inspect IN-TO-OUT-POLICY
 class type inspect IN-TO-OUT-ALLOW-ALL-CLASS
  inspect
 class class-default
  drop log
 

zone security INSIDE
zone security OUTSIDE
zone-pair security IN-TO-OUT source INSIDE destination OUTSIDE
 service-policy type inspect IN-TO-OUT-POLICY
 

interface GigabitEthernet0/0
 description INSIDE_LAN_192_168-1_0
 ip address 192.168.1.1 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
 zone-member security INSIDE
 duplex auto
 speed auto
!
 

interface GigabitEthernet0/1
 description OUTSIDE_INTERNET
 bandwidth 51200
 ip address x.x.x.x 255.255.255.0
 ip nbar protocol-discovery
 ip flow ingress
 ip flow egress
 ip nat outside
 ip virtual-reassembly in
 zone-member security OUTSIDE
 duplex auto
 speed auto
 crypto map vpnmap
 

1 REPLY 1
johnlloyd_13
Engager

hi,

to answer:

1) yes, it already passed the NAT FW since there's NAT translations.

2) since ZBF is chatty and router don't have enough memory/buffer, you could send logs to a syslog server and view the 'dropped' logs.

alternatively, you can use the show policy-map type inspect zone-pair sessions command and pipe the output you want.

 

Content for Community-Ad

This widget could not be displayed.