Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- Cisco Community
- :
- About newcityit
08-18-2017
Stats
Member since
01-23-2014
4
Posts
0
Helpful
0
Solutions
06-09-2014
01:47 PM
10.6.150.1 is a vlan IP for the switch that handles internal routing. It is handing all external traffic off to the ASA. 155.155.155.17 is the gateway on the other side of the ASA. I am not sure why the tracert is ommiting the inside addres of the ASA but there is no other way to get out. The access-list inside_acl extended permit icmp any any is a entry in the ACL on line 2. The blocked host entry is Line 1. Doing further testing on this to answer your question I determined that my original question is a bit of a red herring. My initial problem was trying to resolve a issue with a policy map. Troubleshooting that problem I found that the Access list for the policy was never getting hit. So I reasoned that it was a ACL issue. As a test I set a ping 8.8.8.8 -t on a client in the affected subnet. Then I added 8.8.8.8 to a blocked host rule. When the ping traffic continued I reasoned it was a subnet/ACL issue I described. Silly me. Because the connection was established prior to adding the deny rule it was not interrupted. Once I stopped the persistent ping, and restarted it, the traffic was properly blocked. I am left with my original issue, and none the wiser to the source of my problem. I am trying to set a rate limit on vlan03. The rate limit for colo works as expected. The vlan03 access list is never hit, so I am assuming that is why the policy is not kicking in. access-list rate_limit_colo_acl extended permit ip host 99.99.99.13 any access-list rate_limit_colo_acl extended permit ip any host 99.99.99.13 access-list rate_limit_vlan03_acl extended permit ip 10.6.150.0 255.255.255.0 any access-list rate_limit_vlan03_acl extended permit ip any 10.6.150.0 255.255.255.0 ! class-map rate_limit_colo_map match access-list rate_limit_colo_acl class-map rate_vlan03_map match access-list rate_limit_vlan03_acl class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp policy-map policy_rate_limit_map class rate_limit_colo_map police output 1000000 5000 police input 1000000 5000 class rate_vlan03_map police output 10000 3000 police input 10000 3000 ! service-policy global_policy global service-policy policy_rate_limit_map interface outside
... View more
06-09-2014
12:08 PM
The ASA is the only route out of the environment. I wonder if is a NAT issue. Packet tracers shows a block, but a tracert and ping still work on the client. cdxasa(config)# packet-tracer input inside icmp 10.6.150.1 0 0 8.8.8.8 Phase: 1 Type: FLOW-LOOKUP Subtype: Result: ALLOW Config: Additional Information: Found no matching flow, creating a new flow Phase: 2 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group inside_acl in interface inside access-list inside_acl extended permit icmp any any Additional Information: Phase: 4 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Phase: 6 Type: NAT Subtype: Result: DROP Config: nat (inside) 1 0.0.0.0 0.0.0.0 match ip inside any outside any dynamic translation to pool 1 (155.155.155.18 [Interface PAT]) translate_hits = 20238713, untranslate_hits = 1724138 Additional Information: Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule tracert 8.8.8.8 Tracing route to google-public-dns-a.google.com [8.8.8.8] over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 10.6.150.1 2 82 ms 79 ms 83 ms wsip-155-155-155-17.oc.oc.net [155.155.155.17] 3 135 ms 133 ms 138 ms wsip-155-155-132-249.oc.oc..net [155.155.132.249] 4 116 ms 175 ms 31 ms 155.4.15.250 5 194 ms 148 ms 152 ms ip155-4-11-10.oc.oc.net [155.4.11.10] 6 215 ms 212 ms 199 ms dllsbbrj02-ge020.rd.dl.oc.net [155.1.0.149] 7 202 ms 26 ms 50 ms langbbrj01-ge050000804.r2.la.oc.net [155.105.30. 181] 8 3 ms 3 ms 4 ms 216.239.46.40 9 239 ms 251 ms 239 ms 72.14.238.2 10 74 ms 40 ms 41 ms 72.14.239.159 11 50 ms 44 ms 68 ms 64.233.174.129 12 * * * Request timed out. 13 36 ms 55 ms 35 ms google-public-dns-a.google.com [8.8.8.8] Trace complete.
... View more
06-09-2014
11:22 AM
I am trying to apply an access list to a internal subnet that is different from the inside address of the ASA. The ASA Inside network is a 192.168.1.x network. The network that I am trying to apply an access list too is 10.6.150.x Here is my example config ASA Version 8.2(1) ! interface Ethernet0/0 nameif outside security-level 0 ip address 155.155.155.18 255.255.255.240 ! interface Ethernet0/1 nameif inside security-level 100 ip address 192.168.1.2 255.255.255.0 ! interface Ethernet0/2 shutdown no nameif no security-level no ip address object-group network blocked-hosts network-object host 8.8.8.8 access-list outside_acl extended deny ip object-group blocked-hosts any access-list inside_acl extended deny ip any object-group blocked-hosts global (outside) 1 interface nat (inside) 0 access-list inside_nat0_outbound nat (inside) 1 0.0.0.0 0.0.0.0 access-group outside_acl in interface outside access-group inside_acl in interface inside route outside 0.0.0.0 0.0.0.0 155.155.155.17 1 route inside 10.6.150.0 255.255.255.0 192.168.1.1 1 If I ping host 8.8.8.8 from a 192.168.1.x address the ping is blocked. If I ping host 8.8.8.8 from a 10.6.150.x the ping is allowed. Thank you in advance.
... View more
- Tags:
- #access-list
Labels:
Created by
newcityit
in VPN and AnyConnect
in VPN and AnyConnect
01-23-2014
02:50 PM
01-23-2014
02:50 PM
I am having a VPN issue between a ASA and a Fortigate. I believe that the issue is on the Fortigate side, but some things on the ASA give me pause. In my configuration traffic from the ASA (172.30.8.x) bound for 192.168.1.x or 192.168.2.x goes to the Fortigate via a ipsec VPN. The inside network for the Fortigate is 192.168.1.x. It has a route to 192.168.2.x. VPN traffic works as expected when communicating from 172.30.8.x to 192.168.1.x. No problems there. Traffic going to 192.168.2.x is dropped somewhere. I think this is a Fortigate issue, but I have a doubt because when I do a packet-trace the ASA reports a DROP via ACL, but I have no idea what ACL that is, perhaps implicit. I am including as much information as I have. Any help or suggestions are greatly appreciated. Here is the relevant config. I have a remote access VPN to this network, that also works fine, I included that information, just in case it has some effect. *********Config**************** name 192.168.1.0 remote-indiana-int name 192.168.2.0 remote-ohio-int name 19.51.34.99 remote-indiana-ext name 172.30.8.0 remote-colo-int interface GigabitEthernet0/1 no nameif no security-level no ip address ! interface GigabitEthernet0/1.1 vlan 88 nameif vlan88 security-level 60 ip address 172.30.8.1 255.255.255.0 object-group network remote-internal network-object remote-indiana-int 255.255.255.0 network-object remote-ohio-int 255.255.255.0 access-list outside_vlan88_cryptomap extended permit ip remote-colo-int 255.255.255.0 object-group remote-internal access-list vlan88_nat0_outbound extended permit ip remote-colo-int 255.255.255.0 object-group remote-internal access-list vlan88_nat0_outbound extended permit ip object-group remote-internal remote-colo-int 255.255.255.0 access-list vlan88_nat0_outbound extended permit ip remote-colo-int 255.255.255.0 172.30.8.96 255.255.255.248 access-list vlan88_tunnel_splitTunnelAcl standard permit remote-colo-int 255.255.255.0 ip local pool vlan88_pool 172.30.8.97-172.30.8.102 mask 255.255.255.248 nat (vlan88) 0 access-list vlan88_nat0_outbound nat (vlan88) 1 remote-colo-int 255.255.255.0 crypto ipsec transform-set fortinet esp-3des esp-sha-hmac crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1 crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES -256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5 crypto map outside_map 1 match address outside_vlan88_cryptomap crypto map outside_map 1 set peer remote-indiana-ext crypto map outside_map 1 set transform-set fortinet crypto map outside_map interface outside crypto isakmp enable outside crypto isakmp policy 1 authentication pre-share encryption 3des hash sha group 2 lifetime 86400 group-policy vlan88_tunnel internal group-policy vlan88_tunnel attributes dns-server value 198.153.192.40 198.153.194.40 vpn-tunnel-protocol IPSec split-tunnel-policy tunnelspecified split-tunnel-network-list value vlan88_tunnel_splitTunnelAcl default-domain value eimagesolutions.com tunnel-group 19.51.34.99 type ipsec-l2l tunnel-group 19.51.34.99 ipsec-attributes pre-shared-key ***** **********Packet Trace********************** 5520-01# packet-tracer input vlan88 icmp 172.30.8.55 8 0 192.168.2.2 Phase: 1 Type: ACCESS-LIST Subtype: Result: ALLOW Config: Implicit Rule Additional Information: MAC Access list Phase: 2 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 outside Phase: 3 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Phase: 4 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: class-map inspection_default match default-inspection-traffic policy-map global_policy class inspection_default inspect icmp service-policy global_policy global Additional Information: Phase: 5 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Phase: 6 Type: NAT-EXEMPT Subtype: Result: ALLOW Config: match ip vlan88 remote-colo-int 255.255.255.0 outside remote-ohio-int 255.255.255.0 NAT exempt translate_hits = 1, untranslate_hits = 0 Additional Information: Phase: 7 Type: NAT Subtype: Result: ALLOW Config: nat (vlan88) 1 remote-colo-int 255.255.255.0 match ip vlan88 remote-colo-int 255.255.255.0 outside any dynamic translation to pool 1 (200.200.200.200 [Interface PAT]) translate_hits = 3, untranslate_hits = 0 Additional Information: Phase: 8 Type: NAT Subtype: host-limits Result: ALLOW Config: nat (vlan88) 1 remote-colo-int 255.255.255.0 match ip vlan88 remote-colo-int 255.255.255.0 outside any dynamic translation to pool 1 (200.200.200.200 [Interface PAT]) translate_hits = 3, untranslate_hits = 0 Additional Information: Phase: 9 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Result: input-interface: vlan88 input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule **********Log**************** 5|Jan 23 2014|14:35:26|713119|||||Group = 19.51.34.99, IP = 19.51.34.99, PHASE 1 COMPLETED 6|Jan 23 2014|14:35:26|113009|||||AAA retrieved default group policy (DfltGrpPolicy) for user = 19.51.34.99 6|Jan 23 2014|14:35:26|713172|||||Group = 19.51.34.99, IP = 19.51.34.99, Automatic NAT Detection Status: Remote end is NOT behind a NAT device This end is NOT behind a NAT device 4|Jan 23 2014|14:35:26|113019|||||Group = 19.51.34.99, Username = 19.51.34.99, IP = remote-indiana-ext, Session disconnected. Session Type: IKE, Duration: 0h:10m:33s, Bytes xmt: 0, Bytes rcv: 0, Reason: Lost Service 5|Jan 23 2014|14:35:26|713259|||||Group = 19.51.34.99, IP = 19.51.34.99, Session is being torn down. Reason: Lost Service 3|Jan 23 2014|14:35:26|713902|||||Group = 19.51.34.99, IP = 19.51.34.99, Removing peer from correlator table failed, no match! 3|Jan 23 2014|14:35:26|713902|||||Group = 19.51.34.99, IP = 19.51.34.99, QM FSM error (P2 struct &0x6c372558, mess id 0x242c6faa)! 6|Jan 23 2014|14:34:54|302015|200.200.200.200|500|remote-indiana-ext|500|Built outbound UDP connection 71 for outside:remote-indiana-ext/500 (remote-indiana-ext/500) to identity:200.200.200.200/500 (200.200.200.200/500) 5|Jan 23 2014|14:34:54|713041|||||Group = 19.51.34.99, IP = 19.51.34.99, IKE Initiator: New Phase 2, Intf vlan75, IKE Peer 19.51.34.99 local Proxy Address 172.30.8.0, remote Proxy Address 192.168.2.0, Crypto map (outside_map) *************FORTIGATE************************ config vpn ipsec phase1 edit "GW-FG-ASA" set interface wan1 set dpd disable set dhgrp 2 set proposal 3des-sha1 set keylife 86400 set remote-gw 200.200.200.200 set psksecret ENC ******** end config vpn ipsec phase2 edit Tunnel-FG-ASA set dhgrp 5 set keepalive enable set phase1name GW-FG-ASA set proposal 3des-sha1 set pfs disable set replay disable set keylife-type seconds set keylifeseconds 86400 set src-addr-type subnet set src-subnet 192.168.1.0 255.255.255.0 set dst-addr-type subnet set dst-subnet 172.30.8.0 255.255.255.0 end config firewall address edit "LocalLAN" set subnet 192.168.1.0 255.255.255.0 next edit "colo_net" set subnet 172.30.8.0 255.255.255.0 end edit "ohio" set subnet 192.168.2.0 255.255.255.0 end config firewall policy edit 1 set srcintf internal set dstintf wan1 set srcaddr "LocalLAN ohio" set dstaddr colo_net set action ipsec set inbound enable set outbound enable set natinbound disable set natoutbound disable set schedule always set service ANY set vpntunnel GW-FG-ASA end
... View more
Labels:
06-09-2014
10.6.150.1 is a vlan IP for the switch that handles internal routing. It
is handing all external tra...
06-09-2014
The ASA is the only route out of the environment.I wonder if is a NAT
issue. Packet tracers shows a ...
Created by
newcityit
in VPN and AnyConnect
01-23-2014
01-23-2014
I am having a VPN issue between a ASA and a Fortigate.I believe that the
issue is on the Fortigate s...
Public Statistics
| Date Registered | 01-23-2014 02:07 PM |
| Date Last Visited | 08-18-2017 04:28 AM |
| Total Messages Posted | 4 |
