Have a strange issue here (or what I feel is strange). I have an ASA 5515X series box setup using two interfaces, inside and outside. Using NAT to translate between interfaces. Fairly simple setup. I have a handful of services I allow through the device from outside:some WWW/TLS traffic, email traffic, etc by way of an outside ACL configured on the outside interface. Recently I discovered one of the translated devices had a rogue RDP connection terminated on it from the Internet. The ACL configuration for this device only allowed Email and web traffic to it. Yet there was the RDP connection. I tried connecting to the RDP server off net and sure enough the connection was allowed in. I looked through the ACL to try and figure out how this connection was getting through. I could not find any rule allowing RDP access to this machine in the ACL. I ran packet-tracer to test the connection on the device: packet-tracer input outside tcp 76.70.85.101 3753 <public NAT IP> 3389 Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule So testing in packet tracer shows that the traffic should be dropped by the ACL protecting the outside interface. Yet when I try connecting RDP offnet the traffic bypasses the ACL somehow and gets to the machine: CAB01-ASA5515X-A# sh conn | i 10.20.50.116 UDP outside 24.27.101.164:56835 inside 10.20.50.116:3389, idle 0:00:18, bytes 147162, flags - Here is the relevant configuration: object network mailtest-int host 10.20.50.116 description Internal VDI Workstation Test Mail Server object network mailtest-ext host <public IP> description External VDI Workstation Test Mail Server object network mailtest-int nat (inside,outside) static mailtest-ext object-group service mail tcp description Mail Server Ports port-object eq 366 port-object eq 465 port-object eq 587 port-object eq 993 port-object eq 995 port-object eq imap4 port-object eq pop3 port-object eq smtp port-object eq 1000 port-object eq 3000 port-object eq 3101 port-object eq 4069 port-object eq https port-object eq www access-list outside-in remark Any to Email Test Server for Email Services access-list outside-in extended permit tcp any object mailtest-int object-group mail access-group outside-in in interface outside So why would the device show the traffic as being dropped in packet tracer but then turn around and allow the traffic through, especially when there is not an ACL entry that allows the traffic. I cannot find a single rule in this ACL that would allow it. Is it possible some kind of connection outbound from the PC is getting reused and allowing RDP inbound bypassing the ACL? If I put a deny rule specifically for blocking RDP traffic in the ACL like so: access-list outside-in remark Deny RDP access to Email Test Machine access-list outside-in extended deny tcp any object mailtest-int eq 3389 the traffic gets blocked. If I put an explicit catch all deny any any at the end of the ACL the traffic still gets allowed. I don't normally have that rule as the flow of traffic would be from lower security level to higher security level. Firewall is running Cisco Adaptive Security Appliance Software Version 9.9(1). This host and configurations were recently moved from one site to another. The same basic FW configuration for this host was on the original ASA at the original site and this same issue came up there. Same problem. No RDP access allowed but yet it works. Normally I am trying to get traffic through this thing, not the other way around. Not sure whats going on here. Any help is appreciated. Thanks in advance. ... View more

All,   Setting up some MPF protections for some of our Internet services. I am using MPF to create a class to match traffic out of an ACL, and then am applying some connection limits and parameters on the traffic specified in said ACL. See the relevant configuration:   class-map webserver-protect-class description Webserver Protection Class used to protect Webservers from DOS attacks match access-list webserver-protection policy-map traffic-control-policy description Policy to control and protect Internet Services class webserver-protect-class set connection conn-max 300 embryonic-conn-max 20 access-list webserver-protection extended permit tcp any object-group web-servers-int object-group web   So the ACL just lists a group of destination hosts and services using object-groups. What I am trying to determine is with the above MPF configuration, are the conn-max limits I am imposing going to be set for each host listed in the ACL, or are the limits the total limits for all hosts in the ACL? So for example if I match 10.10.10.5, 10.10.10.6, 10.10.10.7 for WWW connections in the ACL, and impose a 300 conn-max in the MPF policy, does the conn-max apply to 10.10.10.5, 10.10.10.6, and 10.10.10.7 for WWW traffic individually such that each host has a conn-max of 300, or is the 300 conn-max setting a 300 connection total for all of the 10.10.10.5-7 hosts such that only 300 connections across 10.10.10.5-7 as a total are allowed. In other words, only 300 connections are allowed between 10.10.10.5-7 as a total. I think its the former but when I run the command sh service-policy interface OUTSIDE, it seems to show a total in the output so I want to clarify:   Class-map: webserver-protect-class Set connection policy: conn-max 300 embryonic-conn-max 20 current conns 84, drop 0   In the output is it showing a total of all the hosts in the ACL and the number of connections that are open amongst all of them? Hopefully this makes sense what I am asking. Thanks in advance for any help here.   ... View more

Experts,   Not sure what has happened here but after upgrading my ASA to 9.9.1 from 9.6.3, a global MPF policy I had applied was removed from the configuration. This policy was doing default traffic inspection as well as DNS inspection for use with DNS doctoring. I tried re-applying the policy to the device. The device would take the command but not actually add the command to the configuration. I also use an interface policy for traffic policing and DDOS protection so at first I thought the device was no longer allowing the use of both an interface policy and a global policy together. I tried to shift some of the inspection configurations to the interface policy. I got that to work but noticed that one of the commands I added there would not take. Here is what I had in the global policy: policy-map global_policy class inspection_default inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect ipv6 inspect icmp user-statistics scanning   So after moving this inspection config to the interface policy, I noticed that all commands showed in the configuration except for the ' user-statistics scanning ' part. So I removed that from the global policy and re-added the service-policy command to add the global policy to the configuration. This time the device took the command and added it to the configuration. So it seems somewhere between 9.6.3 and 9.9.1, the  user-statistics scanning command has been removed or no longer works. With that command as part of the policy-map, I cannot apply the policy and have it stick in the config. The device takes the command and gives no errors but the command does not show in the configuration. Does anyone know if the  ' user-statistics scanning ' command has been deprecated? Whats the deal here? Thanks in advance for any help.   ... View more

We have an old legacy application which connects to a third party via SSL. The third party provider is limiting connections to using TLS 1.2 beginning in June. Our legacy application can only support TLS 1.0. Upgrading the application seems to be not possible at the moment according to our development team. We use a Cisco ASA 5515X at our border. I was wondering if there was any way to have an ASA 'proxy' TLS sessions for a particular inside host and connect to an Internet host using TLS 1.2 on behalf of the inside host? So something like the inside host (with the ASA as the default route) connects to the ASA outbound, the ASA intercepts this connection, holds it open while connecting to the requested outside host via TLS 1.2. I noticed that the ASA has a TLS proxy of sorts for use with securing VoIP sessions, but I wondered if it could be leveraged here for what I am trying to do. Is there any other way I can have the ASA intercept older TLS sessions and have them be upgraded to TLS 1.2? Thanks in advance for any ideas. ... View more