06-20-2010 04:53 PM
Whenever I use the Packet Tracer in ASDM, I receive Flow is denied by configured rule. But I have rules that allow traffic to go from src - any and any - dst
Why would it do that?
06-20-2010 05:22 PM
Configured rule include inspections, rpf, and other firewall security function (like accelerated security path).
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s2.html#wp1351326
It will be good to look at the overall steps the traffic flow took, and from there, kind of determine, which step previous or next, that may have contributed to the packet being deny.
You may have configured acl to allow source to a destination, but then, the flow may take a different path, due to a misconfigured/conflicted NAT, and result in the deny of the flow.
Regards,
06-21-2010 02:31 PM
The ASA packet tracer is a nice feature, but syslog is a much better diagnostic tool in determining what is preventing functionally.
Chris
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide