Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About Mike Pennycook
06-16-2019
Stats
Member since
02-13-2014
49
Posts
5
Helpful
0
Solutions
10-17-2018
06:40 AM
Thanks Marius
I've configured syslog servers on the ASDM, with a severity of informational and specific class events of 'session/user session' to debugging. The session/user session syslog message should include message 106100, which should log like:
106100
Error Message %PIX|ASA-6-106100: access-list acl_ID {permitted | denied |
est-allowed} protocol interface_name/source_address(source_port) ->
interface_name/dest_address(dest_port) hit-cnt number ({first hit |
number-second interval}) hash codes
https://www.cisco.com/en/US/docs/security/asa/asa80/system/message/logmsgs.html#wp4768518
I have ofcourse set the ACL to log at debug.
The problem with this ACL is I've done packet captures, used 'show conn' and used the real time log monitor on the ASDM as well as looking at netstat on the end server - I simply cannot see those connections
... View more
10-17-2018
05:45 AM
Hi there,
I'm trying to see what traffic is hitting this particular rule:
access-list X line 1 extended permit tcp object-group SRC_X object SRC_X log debugging interval 300 (hitcnt=323) 0xb7788b5f access-list X line 1 extended permit tcp x.x.x.0 255.255.248.0 host 1.1.1.1 log debugging interval 300 (hitcnt=117) 0xdd1a891c access-list X line 1 extended permit tcp x.x.x.0 255.255.248.0 host 1.1.1.1 log debugging interval 300 (hitcnt=206) 0x00417bf4
How exactly would I see the debug logs generated for this ACL? I need to see details of the connection allowed through this ACL
Thanks!
... View more
Labels:
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-23-2018
11:41 PM
09-23-2018
11:41 PM
Hi AJ That’s it, I took off the relay config on the N9K and it worked! Thanks very much!! Regards Shams
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-23-2018
05:33 AM
09-23-2018
05:33 AM
Hi Ajay,
Good point.
The DHCP relay config is on a Nexus 9K, with one physical interface trunking towards the ASA 5516-X. The ASA has 3 subinterfaces each with a DHCP server configured.
On the 9K SVI (default gateway to clients):
interface Vlan554
ip address 192.168.55.254/23 ip dhcp relay address 192.168.55.250
Physical interface is configured as a trunk and allowing the above VLAN:
On ASA:
GigabitEthernet1/2.554 Inside-CWG_Wifi_SBP 192.168.55.250 255.255.254.0 CONFIG
! dhcpd address 192.168.54.10-192.168.55.9 Inside-CWG_Wifi_SBP dhcpd enable Inside-CWG_Wifi_SBP
Earlier on the N9K interface VLAN 554 i tried this:
interface Vlan554
ip address dhcp
And this got an IP! So DHCP is working on the ASA but DHCP relay is not working on the N9K
So when the N9K interface i set to receive an address via DHCP:
> show dhcpd binding
IP address Client Identifier Lease expiration Type
192.168.54.11 0046.444f.3232.3039. 3592 seconds Automatic 3234.5638.566c.616e. 3535.34 > show dhcpd statistics DHCP UDP Unreachable Errors: 0 DHCP Other UDP Errors: 0
Address pools 3 Automatic bindings 1 Expired bindings 0 Malformed messages 0
Message Received BOOTREQUEST 0 DHCPDISCOVER 2 DHCPREQUEST 2 DHCPDECLINE 0 DHCPRELEASE 1 DHCPINFORM 0
Message Sent BOOTREPLY 0 DHCPOFFER 2 DHCPACK 2 DHCPNAK 0
597: 21:08:37.082347 802.1Q vlan#554 P0 0.0.0.0.68 > 255.255.255.255.67: udp 314 598: 21:08:37.082576 802.1Q vlan#554 P0 arp who-has 192.168.54.11 tell 192.168.55.250 599: 21:08:37.180135 802.1Q vlan#554 P0 192.168.55.250.67 > 255.255.255.255.68: udp 290 600: 21:08:38.230029 802.1Q vlan#554 P0 arp who-has 192.168.54.11 tell 192.168.55.250 601: 21:08:39.230044 802.1Q vlan#554 P0 arp who-has 192.168.54.11 tell 192.168.55.250 602: 21:08:43.085780 802.1Q vlan#554 P0 0.0.0.0.68 > 255.255.255.255.67: udp 326 603: 21:08:43.085963 802.1Q vlan#554 P0 192.168.55.250.67 > 255.255.255.255.68: udp 290 604: 21:08:43.230044 802.1Q vlan#554 P0 arp who-has 192.168.54.11 tell 192.168.55.250 605: 21:08:43.471395 802.1Q vlan#554 P6 arp who-has 192.168.54.11 (ff:ff:ff:ff:ff:ff) tell 192.168.54.11 606: 21:08:43.551652 802.1Q vlan#554 P6 arp who-has 192.168.55.250 (ff:ff:ff:ff:ff:ff) tell 192.168.54.11 607: 21:08:43.551775 802.1Q vlan#554 P6 arp reply 192.168.55.250 is-at 28:ac:9e:3b:c9:54 608: 21:08:48.230060 802.1Q vlan#554 P0 arp who-has 192.168.54.11 tell 192.168.55.250 609: 21:08:48.230578 802.1Q vlan#554 P6 arp reply 192.168.54.11 is-at 0:fc:ba:a8:92:d1 610: 21:08:48.230838 802.1Q vlan#554 P0 192.168.55.250 > 192.168.54.11: icmp: echo request 611: 21:08:48.231112 802.1Q vlan#554 P0 192.168.54.11 > 192.168.55.250: icmp: echo reply
The captures in earlier post show when the dhcp relay message gets dropped:
399: 16:08:40.828799 00fc.baa8.92d1 28ac.9e3b.c954 0x8100 Length: 346 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: [udp sum ok] udp 300 (ttl 255, id 51328) Drop-reason: (acl-drop) Flow is denied by configured rule
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-22-2018
01:00 AM
09-22-2018
01:00 AM
looking at detail packet capture for one of the DHCP packets received on the expected interface:
307: 16:08:40.828738 00fc.baa8.92d1 28ac.9e3b.c954 0x8100 Length: 346 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: [udp sum ok] udp 300 (ttl 255, id 51328)
separately in drop packet capture:
398: 16:08:40.798832 00fc.baa8.92d1 28ac.9e3b.c954 0x8100 Length: 346 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: [udp sum ok] udp 300 (ttl 255, id 51072) Drop-reason: (acl-drop) Flow is denied by configured rule
399: 16:08:40.828799 00fc.baa8.92d1 28ac.9e3b.c954 0x8100 Length: 346 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: [udp sum ok] udp 300 (ttl 255, id 51328) Drop-reason: (acl-drop) Flow is denied by configured rule
400: 16:08:42.456839 00fc.baa8.92d1 28ac.9e3b.c954 0x8100 Length: 346 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: [udp sum ok] udp 300 (ttl 255, id 51584) Drop-reason: (acl-drop) Flow is denied by configured rule
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-22-2018
12:50 AM
09-22-2018
12:50 AM
Hi Marvin,
Thanks -
> show asp table socket stats
TCP Statistics: Rcvd: total 0 checksum errors 0 no port 0 Sent: total 0
UDP Statistics: Rcvd: total 0 checksum errors 0 Sent: total 0 copied 0 Dropped: Rcv queue full 0
NP SSL System Stats: Handshake Started: 0 Handshake Complete: 0 SSL Open: 0 SSL Close: 0 SSL Server: 0 SSL Server Verify: 0 SSL Client: 0
> > > > show asp table socket
Protocol Socket State Local Address Foreign Address >
Packet capture:
476: 07:42:16.831179 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0 477: 07:42:44.529422 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0 478: 07:44:10.373744 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0 479: 07:44:13.255067 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0 480: 07:44:15.266480 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0 481: 07:44:17.405984 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 0
192.168.55.250 is the DHCP server interface
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-22-2018
12:44 AM
09-22-2018
12:44 AM
Thanks for the suggestion, Unfortunately I’m not on site to generate DHCP packets but the packet tracer output says it’s denied by an implicit rule: Phase: 5 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule <<<<<<< Additionally packet tracer shows: Additional Information: Forward Flow based lookup yields rule: in id=0x2aaada976990, priority=0, domain=permit, deny=true is that id the ACL id?
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
09-21-2018
09:21 AM
09-21-2018
09:21 AM
Hi All
Please help me find out why this FTD ASA 5516-X is dropping DHCP packets even after I've allowed it on the ACL:
Phase: 5 Type: ACCESS-LIST Subtype: Result: DROP Config: Implicit Rule Additional Information: Forward Flow based lookup yields rule: in id=0x2aaada976990, priority=0, domain=permit, deny=true hits=725, user_data=0xa, cs_id=0x0, use_real_addr, flags=0x1000, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0 input_ifc=Inside-CWG_Wifi_SBP, output_ifc=any
Result: input-interface: Inside-CWG_Wifi_SBP input-status: up input-line-status: up output-interface: NP Identity Ifc Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
>
393: 16:08:19.513050 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 300 Drop-reason: (acl-drop) Flow is denied by configured rule 394: 16:08:20.695459 802.1Q vlan#554 P0 192.168.55.254.67 > 192.168.55.250.67: udp 300 Drop-reason: (acl-drop) Flow is denied by configured rule
192.168.55.250 is the DHCP server on this ASA. As the packets are dropped there are no DHCP packets registered:
> show dhcpd statistics DHCP UDP Unreachable Errors: 0 DHCP Other UDP Errors: 0
Address pools 3 Automatic bindings 0 Expired bindings 0 Malformed messages 0
Message Received BOOTREQUEST 0 DHCPDISCOVER 0 DHCPREQUEST 0 DHCPDECLINE 0 DHCPRELEASE 0 DHCPINFORM 0
ACL has been allowed for this:
access-list CSM_FW_ACL_ line 27 remark rule-id 268436481: L7 RULE: DHCP access-list CSM_FW_ACL_ line 28 advanced permit udp ifc Inside any eq bootps any eq bootps rule-id 268436481 (hitcnt=0) 0xe4664fff access-list CSM_FW_ACL_ line 29 advanced permit udp ifc Inside any eq bootps any eq bootpc rule-id 268436481 (hitcnt=0) 0xe74f89e5 access-list CSM_FW_ACL_ line 30 advanced permit udp ifc Inside any eq bootpc any eq bootps rule-id 268436481 (hitcnt=0) 0x51f2199b access-list CSM_FW_ACL_ line 31 advanced permit udp ifc Inside any eq bootpc any eq bootpc rule-id 268436481 (hitcnt=0) 0x38d1b7c1 access-list CSM_FW_ACL_ line 32 advanced permit udp ifc Inside-TP-Desktop any eq bootps any eq bootps rule-id 268436481 (hitcnt=0) 0x61419d5e access-list CSM_FW_ACL_ line 33 advanced permit udp ifc Inside-TP-Desktop any eq bootps any eq bootpc rule-id 268436481 (hitcnt=0) 0xbbd2c408 access-list CSM_FW_ACL_ line 34 advanced permit udp ifc Inside-TP-Desktop any eq bootpc any eq bootps rule-id 268436481 (hitcnt=0) 0xa610180f access-list CSM_FW_ACL_ line 35 advanced permit udp ifc Inside-TP-Desktop any eq bootpc any eq bootpc rule-id 268436481 (hitcnt=0) 0x5f42843b access-list CSM_FW_ACL_ line 36 advanced permit udp ifc Inside-CWG_Wifi_SBP any eq bootps any eq bootps rule-id 268436481 (hitcnt=0) 0x5af3a636 access-list CSM_FW_ACL_ line 37 advanced permit udp ifc Inside-CWG_Wifi_SBP any eq bootps any eq bootpc rule-id 268436481 (hitcnt=0) 0xe6b86f1b access-list CSM_FW_ACL_ line 38 advanced permit udp ifc Inside-CWG_Wifi_SBP any eq bootpc any eq bootps rule-id 268436481 (hitcnt=0) 0xd7403e07 access-list CSM_FW_ACL_ line 39 advanced permit udp ifc Inside-CWG_Wifi_SBP any eq bootpc any eq bootpc rule-id 268436481 (hitcnt=0) 0x677af08d access-list CSM_FW_ACL_ line 40 advanced permit udp ifc AP_Management any eq bootps any eq bootps rule-id 268436481 (hitcnt=0) 0x1ed16681 access-list CSM_FW_ACL_ line 41 advanced permit udp ifc AP_Management any eq bootps any eq bootpc rule-id 268436481 (hitcnt=0) 0x5826aa69 access-list CSM_FW_ACL_ line 42 advanced permit udp ifc AP_Management any eq bootpc any eq bootps rule-id 268436481 (hitcnt=0) 0xd6d350d0 access-list CSM_FW_ACL_ line 43 advanced permit udp ifc AP_Management any eq bootpc any eq bootpc rule-id 268436481 (hitcnt=0) 0x93785eef
... View more
Created by
Mike Pennycook
in Wireless Security and Network Management
in Wireless Security and Network Management
05-10-2018
03:57 AM
05-10-2018
03:57 AM
Thanks Leo!
... View more
Created by
Mike Pennycook
in Wireless Security and Network Management
in Wireless Security and Network Management
05-10-2018
03:47 AM
05-10-2018
03:47 AM
What was the fix?
... View more
Created by
Mike Pennycook
in Wireless Security and Network Management
in Wireless Security and Network Management
05-08-2018
06:36 AM
05-08-2018
06:36 AM
Ah ok, I ask as we are hitting this bug on a new batch of 2802s..
... View more
Created by
Mike Pennycook
in Wireless Security and Network Management
in Wireless Security and Network Management
05-08-2018
05:28 AM
05-08-2018
05:28 AM
Hi Rasika, Thanks for the useful info. We have a batch of 2802 APs, are you aware of a field notice for them? Thanks! Shams
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
05-04-2018
04:40 AM
05-04-2018
04:40 AM
Hi Marvin,
Great that showed my route!
What is the show route management-only used for? In my case it still shows as blank, but comes up in netstat in Linux
Regards
Shams
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
05-03-2018
06:35 AM
05-03-2018
06:35 AM
The problem is fixed, but can anyone describe what this command actually does:
> show route management-only
Routing Table: mgmt-only Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2 E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2 ia - IS-IS inter area, * - candidate default, U - per-user static route o - ODR, P - periodic downloaded static route, + - replicated route Gateway of last resort is not set
-
I've put in a static route for the management interface using:
> configure network static-routes ipv4 add br1 172.16.72.167 255.255.252.0 192.1 68.50.25
however it doesn't show up in the above command?
Thanks!
... View more
Created by
Mike Pennycook
in Firewalls
in Firewalls
05-03-2018
01:23 AM
05-03-2018
01:23 AM
Appliance Heartbeat 2018-05-03 09:17:57 Appliance ASA-5516-X is not sending heartbeats.
... View more
05-13-2019
Hi Grant, You are right, I've spent time with TAC today and it was found
that the SFR module on the ...
05-12-2019
Just read another post on the SFR module where Marvin mentioned these
modules have no concept of act...
05-12-2019
Hi Marvin, That's my understanding as well reading up on the topic. I
have that book too but unfortu...
05-12-2019
Hi Grant, Yes please, that would be much appreciated, thanks I just
checked, for that access control...
05-12-2019
Hi Grant, Thanks for your input With regards to the action defined in
the access control rules, all ...
05-12-2019
Hi Marvin, Thanks very much for your response We are using FMC to manage
the SFR module on the ASA 5...
Created by
Mike Pennycook
in FirePOWER
05-11-2019
05-11-2019
Hi All Hope you're well We have an SFR/Firepower SSD installed in an ASA
5545-X in monitor only mode...
11-01-2018
Hi All, Is there a way to filter connections in FMC (Analysis >
Connection > Events) so that you can...
10-17-2018
Thanks Marius I've configured syslog servers on the ASDM, with a
severity of informational and speci...
10-17-2018
Hi there, I'm trying to see what traffic is hitting this particular
rule: access-list X line 1 exten...
Created by
Mike Pennycook
in Firewalls
09-23-2018
09-23-2018
Hi AJThat’s it, I took off the relay config on the N9K and it
worked!Thanks very much!!RegardsShams
Created by
Mike Pennycook
in Firewalls
09-23-2018
09-23-2018
Hi Ajay, Good point. The DHCP relay config is on a Nexus 9K, with one
physical interface trunking to...
Created by
Mike Pennycook
in Firewalls
09-22-2018
09-22-2018
looking at detail packet capture for one of the DHCP packets received on
the expected interface: 307...
Created by
Mike Pennycook
in Firewalls
09-22-2018
09-22-2018
Hi Marvin, Thanks - > show asp table socket stats TCP Statistics: Rcvd:
total 0 checksum errors 0 no...
Created by
Mike Pennycook
in Firewalls
09-22-2018
09-22-2018
Thanks for the suggestion,Unfortunately I’m not on site to generate DHCP
packets but the packet trac...
Public Statistics
| Date Registered | 02-13-2014 03:02 AM |
| Date Last Visited | 06-16-2019 02:41 PM |
| Total Messages Posted | 49 |
| Total Helpful Votes Received | 5 |
Helpful Votes Given To
.jpg "Hall of Fame Master"){kind=icon}
.jpg "VIP Advocate"){kind=icon}
