xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd NuLKvvWGg.x9HEKO encrypted
names
ip local pool VPN_POOL xxx.xxx.xxx.xxx - xxx.xxx.xxx.xxx mask 255.255.255.240
!
interface GigabitEthernet0/0
description To-HEX-CORE-02-ge-1/0/2_VPN
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.248
!
interface GigabitEthernet0/1
description To-HEX-SRX-02-ge-0/0/10
nameif inside
security-level 100
ip address x.x.x.x 255.255.255.252
ftp mode passive
object network The_Hub
host x.x.x.x
object network Console_Ext
host x.x.x.x
object network Console_Int
host x.x.x.x
object network Test_Int
host x.x.x.x
object-group icmp-type svc_ICMP_types_allowed
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
icmp-object unreachable
access-list SPLIT_TUNNEL standard permit x.x.x.x255.255.255.0
access-list outside_to_inside extended permit ip object The_Hub object Console_Int
access-list inside_to_outside extended permit ip any4 any4
access-list inside_to_outside extended permit ip object Console_Ext object The_Hub
access-list natcap extended permit ip any4 host x.x.x.x
access-list insidecap extended permit ip host x.x.x.x any4
pager lines 50
mtu outside 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-791-151.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (outside,inside) source static The_Hub The_Hub destination static Console_Ext Console_Int
nat (inside,outside) source static Console_Int Console_Ext destination static The_Hub The_Hub
access-group outside_to_inside in interface outside
access-group inside_to_outside in interface inside
route outside 0.0.0.0 0.0.0.0 x.x.x.x
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication login-history
http server enable
http x.x.x.x 255.255.255.255 outside
http 0.0.0.0 0.0.0.0 inside
http redirect outside 80
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
crypto ikev1 enable inside
telnet timeout 5
ssh stricthostkeycheck
ssh x.x.x.x 255.255.255.255 outside
ssh x.x.x.x 255.255.255.255 outside
ssh x.x.x.x 255.255.255.255 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 30
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
anyconnect keep-installer installed
anyconnect dpd-interval client 30
anyconnect ask none default anyconnect
dynamic-access-policy-record DfltAccessPolicy
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly 23
subscribe-to-alert-group configuration periodic monthly 23
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:ef081ba9597dbf55affc7b83b34cffc4
Log files show as "Empty". Here is the "packet-tracer" readout:
packet-tracer input outside tcp x.x.x.x ssh x.x.x.x ssh detailed
Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaac85180a0, priority=13, domain=capture, deny=false
hits=353683, user_data=0x2aaac8fbfa50, cs_id=0x0, l3_type=0x0
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0000.0000.0000
input_ifc=outside, output_ifc=any
Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaac8498c90, priority=1, domain=permit, deny=false
hits=117935, user_data=0x0, cs_id=0x0, l3_type=0x8
src mac=0000.0000.0000, mask=0000.0000.0000
dst mac=0000.0000.0000, mask=0100.0000.0000
input_ifc=outside, output_ifc=any
Phase: 3
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop x.x.x.x using egress ifc outside
Phase: 4
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x2aaac849c080, priority=111, domain=permit, deny=true
hits=50402, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=outside, output_ifc=outside
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
I can confirm that the packets are hitting the "outside" interface as when I complete a capture, they are all there. No packets appear on the inside interface capture. This is because they are hitting the implicit deny all from the packet tracer readout.
Any help would be greatly appreciated.
Thanks
