Hello everyone,
I am encountering an issue with my ASA 5515X running ASA Version 9.1(2) where traffic from devices in VLAN 99 cannot communicate with an external network (specifically 10.0.0.0/8).
Here is an overview of my network configuration:
ASA Configuration:
Interfaces and VLANs:
interface Port-channel1.99
vlan 99
nameif vlan99
security-level 0
ip address 172.16.99.1 255.255.255.0
Access Lists:
access-list vlan99_access_in extended permit ip any any
access-list acl-amzn extended permit ip any4 any4
access-list amzn-filter extended permit ip any4 any4
Crypto Map:
crypto map amzn_vpn_map 1 match address acl-amzn
crypto map amzn_vpn_map interface outside
Routes:
route outside 0.0.0.0 0.0.0.0 PUBLIC_DCIPADDR 1
Problem Description:
I have servers on VLAN 99 behind an esx tagged on vlan 99 with IP addresses such as 172.16.99.21 and 172.16.99.50. These servers need to communicate with an external server at 10.24.10.254. Despite having configured the access lists to permit all traffic, I am seeing deny logs for ICMP and UDP traffic from these VLAN 99 addresses to the external server.
Log Entries:
Here are some relevant log entries:
Deny inbound icmp src vlan99:172.16.99.50 dst outside:10.24.10.254 (type 8, code 0)
Deny inbound UDP from 172.16.99.110/59385 to 10.24.10.254/53 due to DNS Query
Configuration Details
ACL vlan99_access_in is applied to the vlan99 interface and allows all IP traffic:
access-list vlan99_access_in extended permit ip any any
ACL acl-amzn used for VPN matches all traffic:
access-list acl-amzn extended permit ip any4 any4
Group Policy VPN Filter uses the ACL amzn-filter which also allows all traffic:
access-list amzn-filter extended permit ip any4 any4
Actions Taken were
Verified that vlan99_access_in allows all IP traffic.
Ensured that acl-amzn and amzn-filter permit all traffic.
Checked that the crypto map is correctly applied to the outside interface.
Temporarily disabled protocol inspections in the global policy to rule out inspection issues.
Current Configuration :
access-list vlan99_access_in extended permit ip any any
access-group vlan99_access_in in interface vlan99
access-list acl-amzn extended permit ip any4 any4
crypto map amzn_vpn_map 1 match address acl-amzn
crypto map amzn_vpn_map interface outside
access-list amzn-filter extended permit ip any4 any4
policy-map global_policy
class inspection_default
no inspect icmp
no inspect udp
Despite these configurations, the traffic is still being blocked. I suspect there might be an issue with the VPN configuration or some other aspect that I'm missing.
Request for Help:
I would appreciate any guidance or suggestions on what might be causing these blocks and how to resolve them. Specifically, how can I ensure that traffic from VLAN 99 (172.16.99.0/24) can reach the external network (10.0.0.0/8)?
Thank you in advance for your assistance!
