Diagnosing and Troubleshooting ACL's

[shankm001]

Hi all,

Just wanted some advice on the best way to troubleshoot ACL's on an ASA.  

Yesterday while configuring our VPN to AWS, i added a permit ip any any onto the end of an ACL to avoid the implied deny, however it dropped all external (internet access).  From what i know there was a conflict with ACL's somewhere and i would like to find out where.

Is there a way to do this?

Cheers

[Dennis Mink]

If you are running an ASA, use the packet tracer tool in the Cisco ASA, to see, what ACL gets hits for certain interesting traffic.

[shankm001]

That's awesome, thanks for that!

Now i can see it is being dropped by an ACL, how do i find out which ACL it is?

It passes Phase 1: access list, Phase 2: Route Lookup, Phase 3: UN-NAT, but fails Phase 4: Access-List.

[shankm001]

I tried running the packet-tracer command from a different Interfaces IP, for ICMP type 8 code 8.

All results came up allow, however using that interfaces IP as the source, i still do not get a ping response.

However, with hosts within that Interface's range i can get a ping response, also i can ping the ASA's outside interface IP from the other end of the connection, that i am trying to ping (it is an instance in AWS).  The VPN tunnel is up as well.

[shankm001]

Out of curiosity, when would you use the crypto map set reverse-route setting?

One of our guys here says to set it so the other internal networks can communicate with the VPN

[Dennis Mink]

I havent got it in front of me, but doesnt it tell you exactly why your packet is dropped in phase 4?  can you add a screen shot, so we can have a look at what you are seeing?

[shankm001]

Sorry was phase 3

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fff9f54fd90, priority=500, domain=permit, deny=true
hits=3, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=x.x.x.x, mask=255.255.255.255, port=0, tag=0
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
input_ifc=outside, output_ifc=any