3

I have a massive ACL that i'm dealing with and I can't seem to find what line is blocking me. Is there a way for packet-tracer to help me figure out more specifically where i'm getting blocked at?

packet-tracer input AAAA tcp 10.A.B.1 5555 10.C.D.80 PORT# d

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         AAAA

Phase: 4
Type: ACCESS-LIST
Subtype: 
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ffd9a7f9e40, priority=111, domain=permit, deny=true
        hits=28704780, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dscp=0x0
        input_ifc=AAAA, output_ifc=AAAA

Result:
input-interface: AAAA
input-status: up
input-line-status: up
output-interface: AAAA
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Some clues that I have gathered (not sure if they are correct though)

  • The drop reason indicates that a configured line is dropping the packet and not the default deny at the end
  • The packet is getting denied at the output ACL on interface AAAA
  • There is a id string and a hit counter but I don't know how to match that up with anything
Improve this question

2 Answers 2

Reset to default
4

Implicit Rule and AAAA being the in and out interface... That's called hair-pinning, and it's generally not allowed. It works on my asa, but I have the following enabled:

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
Improve this answer
2
  • That makes sense but "same-security-traffic permit inter-interface" is enabled on this firewall, could the block be that the intra-interface isn't enabled?
    – evolvd
    Jan 20, 2014 at 20:54
  • @evolvd, yes. To allow traffic to enter and exit the same interface, you need the "intra-interface" statement (see here for more details). The "inter-interface" command allows traffic to enter and exit two different interfaces that have the same security level.
    – YLearn
    Sep 15, 2015 at 2:27
-1

Cisco ASA (acl-drop) Flow is denied by configured rule

Pete

Improve this answer
1

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.