I have a Cisco ASA, which is denying traffic from 172.16.1.5 to 220.127.116.11 on tcp/9000
How can I diagnose why this is happening from the Cisco ASA CLI?
Stack Exchange network consists of 181 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.Visit Stack Exchange
Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.Sign up to join this community
The easiest way to figure out why your ASA drops traffic:
capture [NAME] asp-drop
packet-tracer(only on routed ASA firewalls):
Routed firewalls give us the most information when we need to figure out why something was dropped; it's best to use
packet-tracer to figure out why the routed firewall dropped something (although it won't catch every possible case).
I'm assuming 172.16.1.5's source port is 1024 for the purposes of getting a diagnosis... The syntax is
packet-tracer input INSIDE tcp [SRC_HOST] [SRC_PORT] [DST_HOST] [DST_PORT]
asa-fw# packet-tracer input INSIDE tcp 172.16.1.5 1024 18.104.22.168 9000 !!! output truncated Phase: 4 Type: ACCESS-LIST Subtype: log Result: DROP <---- ASA Dropped the traffic Config: access-group INSIDE_in in interface INSIDE access-list INSIDE_in extended deny ip any4 any4 log <---- This rule denied the traffic Additional Information: Result: input-interface: INSIDE input-status: up input-line-status: up output-interface: OUTSIDE output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule <---- asa-fw#
capture [NAME] asp-drop(routed or transparent ASA firewalls):
Transparent firewalls are trickier to diagnose, but you can still get some useful information with the
capture ... asp-drop command. The ASP is the ASA's "Accelerated Security Path"; this is where many drops happen. I have seen some dropped traffic that doesn't show in
asp-drop, but usually that's because of an overwhelmed backplane in the ASA.
There are four steps...
capture [CAPTURE_NAME] type asp-drop all buffer [BUFFER_SIZE] match tcp host [SRC_HOST] host [DST_HOST] eq [DST_PORT]
show capture [NAME] traceto understand why the traffic was denied.
no capture [CAPTURE_NAME]
This is an example which shows traffic to 22.214.171.124 on tcp/9000 is denied by a configured firewall rule.
asa-fw# capture DENY type asp-drop all buffer 500000 match tcp host 172.16.1.5 host 126.96.36.199 eq 9000 asa-fw# sh capture DENY trace 1 packet captured 1: 06:13:43.434761 802.1Q vlan#200 P0 172.16.1.5.33489 > 188.8.131.52.9000: S 884023774:884023774(0) win 14600 <mss 1460,sackOK,timestamp 67442169 0,nop,wscale 7> Drop-reason: (acl-drop) Flow is denied by configured rule ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ 1 packet shown asa-fw# no capture DENY
When you finish, be sure to unconfigure the capture with
no capture DENY