Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL

Question

I'm trying to allow VPN access through a specific public IP address on our company ASA. The ASA is currently configured with a /29 public IP address as follows:

Interface Ethernet0/0 "outside"
IP address xx.xx.xx.218, subnet mask 255.255.255.248

The https port on .218 is used for a web server inside the network, so I would like to use .219 for the web VPN instead.

However, packet tracer reports that it is dropping https packets to .219 based on the implicit deny rule for the outside interface.

I put in a temporary ACL to allow all traffic from my home IP address:

access-list outside_in line 1 extended permit ip host xx.xx.108.109 host xx.xx.xx.219 any

Re-running the packet tracer command shows that https traffic from xx.xx.108.109 is still being dropped by the implicit deny.

#packet-tracer input outside tcp xx.xx.108.109 https xx.xx.xx.219 https detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   xx.xx.xx.216   255.255.255.248 outside

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xab839048, priority=111, domain=permit, deny=true
        hits=39497, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
        src ip=0.0.0.0, mask=0.0.0.0, port=0
        dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Any insight into this problem would be great. I don't understand why it is blocking any traffic from xx.xx.108.109, as it should be passed by the first ACL on that interface. Am I missing something?

Sanitized ASA running-config:

: Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1599 MHz
:
ASA Version 8.2(5)59
!
hostname ***
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address xx.xx.xx.218 255.255.255.248
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 10.100.0.2 255.255.255.0
!
interface Ethernet0/2
 speed 100
 duplex full
 nameif guest-access
 security-level 10
 ip address 192.168.169.1 255.255.255.0
!
interface Ethernet0/3
 shutdown
 no nameif
 security-level 20
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
dns server-group DefaultDNS
 domain-name ***.local
object-group network blocked-nets
 network-object ChinaBlock-211.95.0.0 255.255.0.0
 network-object ChinaBlock-211.94.0.0 255.255.0.0
 network-object ChinaBlock-211.93.0.0 255.255.0.0
 network-object ChinaBlock-211.92.0.0 255.255.0.0
 network-object ChinaBlock-211.97.0.0 255.255.0.0
 network-object ChinaBlock-211.91.0.0 255.255.0.0
 network-object ChinaBlock-211.96.0.0 255.255.0.0
 network-object ChinaBlock-211.90.0.0 255.255.0.0
 network-object SwedenBlock-212.214.70.0 255.255.255.0
 network-object 189.0.0.0 255.0.0.0
 network-object 221.0.0.0 255.0.0.0
 network-object 59.0.0.0 255.0.0.0
 network-object 124.0.0.0 255.0.0.0
 network-object 58.0.0.0 255.0.0.0
 network-object 219.0.0.0 255.0.0.0
 network-object 203.0.0.0 255.0.0.0
 network-object 202.0.0.0 255.0.0.0
 network-object 220.0.0.0 255.0.0.0
 network-object 211.0.0.0 255.0.0.0
 network-object 213.0.0.0 255.0.0.0
 network-object 212.0.0.0 255.0.0.0
 network-object 222.0.0.0 255.0.0.0
 network-object 200.0.0.0 255.0.0.0
 network-object 201.0.0.0 255.0.0.0
 network-object 195.0.0.0 255.0.0.0
 network-object 194.0.0.0 255.0.0.0
 network-object 193.0.0.0 255.0.0.0
 network-object 190.0.0.0 255.0.0.0
 network-object 62.0.0.0 255.0.0.0
 network-object 61.0.0.0 255.0.0.0
 network-object 60.0.0.0 255.0.0.0
 network-object 89.0.0.0 255.0.0.0
 network-object 88.0.0.0 255.0.0.0
 network-object 87.0.0.0 255.0.0.0
 network-object 86.0.0.0 255.0.0.0
 network-object 85.0.0.0 255.0.0.0
 network-object 84.0.0.0 255.0.0.0
 network-object 83.0.0.0 255.0.0.0
 network-object 82.0.0.0 255.0.0.0
 network-object 81.0.0.0 255.0.0.0
 network-object 80.0.0.0 255.0.0.0
access-list inside_out extended permit tcp host 10.1.1.32 host 192.168.49.17 eq 3389
access-list inside_out extended permit icmp any any
access-list inside_out extended deny ip any 192.168.49.0 255.255.255.0
access-list inside_out extended permit tcp any any eq www
access-list inside_out extended permit tcp any any eq https
access-list inside_out extended permit tcp any any eq ftp
access-list inside_out extended permit tcp any any eq pop3
access-list inside_out extended permit tcp any any eq smtp
access-list inside_out extended permit udp any any eq domain
access-list inside_out extended permit udp any any eq ntp
access-list inside_out extended permit tcp any any eq 3389
access-list inside_out extended permit tcp any any eq 465
access-list inside_out extended permit tcp any any eq 995
access-list inside_out extended permit tcp any any eq 993
access-list inside_out extended permit tcp host 10.1.1.15 any eq www
access-list inside_out extended permit udp host 10.1.1.15 any eq domain
access-list inside_out extended permit ip 10.1.1.0 255.255.255.0 client_vpn-10.1.50.0 255.255.255.0
access-list inside_out extended permit udp host 10.1.1.2 any eq time
access-list inside_out extended permit tcp any any eq 3334
access-list inside_out extended permit udp any any eq 3334
access-list inside_out extended permit tcp host 10.1.1.12 any eq 2847
access-list inside_out extended permit tcp host 10.1.1.14 any eq ssh
access-list inside_out extended permit tcp host 10.1.1.14 any eq telnet
access-list inside_out extended permit tcp host 10.1.1.14 any eq smtp
access-list inside_out extended permit tcp host 10.1.1.25 any eq 3389
access-list inside_out extended permit udp host 10.1.1.14 any eq snmp
access-list inside_out extended permit udp any any eq isakmp
access-list inside_out extended permit udp any any eq 4500
access-list inside_out extended permit udp host 10.1.1.11 any eq ntp
access-list inside_out extended permit udp host 10.1.1.11 any eq domain
access-list inside_out extended permit tcp any any eq 81
access-list inside_out extended deny udp host 10.1.1.11 any eq snmp log disable
access-list inside_out extended permit tcp any any eq 3390
access-list inside_out extended permit tcp any any eq 23111
access-list inside_out extended permit ip any 10.1.6.0 255.255.255.0
access-list inside_out extended permit ip host 10.100.3.10 any
access-list inside_out extended permit tcp any any eq 8443
access-list inside_out extended permit tcp any any eq 23038
access-list inside_out extended permit tcp any any eq 9506
access-list inside_out extended permit tcp any any eq 9516
access-list inside_out extended permit tcp any any range 42001 42004
access-list inside_out extended permit tcp any any eq 9965
access-list inside_out extended permit tcp any any eq citrix-ica
access-list inside_out extended permit ip any 10.1.7.0 255.255.255.0
access-list inside_out extended permit ip any 192.168.30.0 255.255.255.0
access-list inside_out extended permit ip any 192.168.20.0 255.255.255.0
access-list inside_out extended permit tcp any any eq 9922
access-list inside_out extended permit tcp any any eq 2021
access-list inside_out extended permit tcp any any eq imap4
access-list inside_out extended permit tcp any any eq 587
access-list inside_out extended permit tcp any any object-group accenthealth-tcp
access-list inside_out extended permit tcp host exch-db-01-10.1.1.27 any eq smtp
access-list inside_out extended permit tcp any any eq 50
access-list inside_out extended permit tcp host 10.100.0.10 any eq 873
access-list inside_out extended permit tcp host 10.100.0.10 any eq ssh
access-list inside_out extended deny udp any any eq snmp log disable
access-list inside_out extended permit ip any 10.50.106.0 255.255.255.0
access-list inside_out extended permit ip 10.1.1.0 255.255.255.0 172.16.96.0 255.255.255.0
access-list inside_out extended permit tcp host 10.1.8.128 any eq telnet
access-list outside_in extended permit tcp host hh.hh.108.109 host xx.xx.xx.219 eq https
access-list outside_in extended permit ip host hh.hh.108.109 any
access-list outside_in extended deny ip object-group blocked-nets any log disable
access-list outside_in extended permit icmp any any echo-reply
access-list outside_in extended permit icmp any any time-exceeded
access-list outside_in extended permit tcp any host xx.xx.xx.218 eq https
access-list outside_in extended permit ip 10.50.106.0 255.255.255.0 any
access-list outside_in extended permit ip 172.16.96.0 255.255.255.0 any log debugging
access-list outside_in extended permit ip host 199.91.140.80 any
access-list outside_in extended permit ip host 70.115.144.28 any
access-list ipsec-gts extended permit ip 10.1.1.0 255.255.255.0 192.168.49.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 client_vpn-10.1.50.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 SSLVPN_Client-10.1.51.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.14 host 66.106.106.202
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 10.1.11.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 10.50.191.0 255.255.255.0
access-list no_nat extended permit ip 10.100.0.0 255.255.0.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.2.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.42 192.168.169.0 255.255.255.0
access-list no_nat extended permit ip 192.168.1.0 255.255.255.0 client_vpn-10.1.50.0 255.255.255.0
access-list no_nat extended permit ip 192.168.1.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 192.168.20.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip host 192.168.1.11 10.20.2.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.36 10.20.2.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.29 10.20.2.0 255.255.255.0
access-list no_nat extended permit ip host 192.168.1.48 10.20.2.0 255.255.255.0
access-list no_nat extended permit ip host 192.168.1.11 10.20.4.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.36 10.20.4.0 255.255.255.0
access-list no_nat extended permit ip host 10.1.1.29 10.20.4.0 255.255.255.0
access-list no_nat extended permit ip host 192.168.1.48 10.20.4.0 255.255.255.0
access-list no_nat extended permit ip 10.1.7.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.1.0 255.255.255.0 192.168.49.0 255.255.255.0
access-list no_nat extended permit ip 192.168.30.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list no_nat extended permit ip 10.1.8.0 255.255.255.0 10.1.6.0 255.255.255.0
access-list IPSEC_VPN_splitTunnelAcl standard permit 10.1.1.0 255.255.255.0
access-list IPSEC_VPN_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list guest-access extended permit tcp any host 10.1.1.42 eq https
access-list guest-access extended permit tcp any host 10.1.1.41 eq https
access-list guest-access extended deny ip any 10.0.0.0 255.0.0.0
access-list guest-access extended permit icmp any any
access-list guest-access extended permit udp any any eq domain
access-list guest-access extended permit udp any any eq ntp
access-list guest-access extended permit udp any any eq 4500
access-list guest-access extended permit udp any any eq isakmp
access-list guest-access extended permit gre any any
access-list guest-access extended permit tcp any any eq pptp
access-list guest-access extended permit tcp any any eq www
access-list guest-access extended permit tcp any any eq https
access-list guest-access extended permit tcp any any eq ftp
access-list guest-access extended permit tcp any any eq 8080
access-list guest-access extended permit tcp any any eq 8443
access-list guest-access extended permit tcp any any eq 995
access-list guest-access extended permit tcp any any eq 993
access-list guest-access extended permit tcp any any eq 587
access-list guest-access extended permit tcp any any eq 3390
access-list guest-access extended permit tcp any any eq 3389
access-list guest-access extended permit tcp any any eq smtp
access-list guest-access extended permit tcp any any eq pop3
access-list guest-access extended permit tcp any any eq imap4
access-list 1 extended permit ip any host 10.100.3.10
access-list 1 extended permit ip host 10.100.3.10 any
access-list tcp-traffic extended permit tcp any any
pager lines 24
logging enable
logging timestamp
logging buffered warnings
logging trap warnings
logging history errors
logging asdm warnings
logging host inside 10.1.1.14
no logging message 313001
mtu outside 1500
mtu inside 1500
mtu guest-access 1500
ip local pool client_vpn 10.1.50.1-10.1.50.254
ip local pool SSLVPN_Client 10.1.51.1-10.1.51.254 mask 255.255.255.0
ip verify reverse-path interface outside
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo-reply outside
icmp permit any time-exceeded outside
asdm image disk0:/asdm-721.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
global (outside) 2 ww.ww.ww.178
global (outside) 3 xx.xx.xx.219
nat (inside) 0 access-list no_nat
nat (inside) 2 access-list hca-nat
nat (inside) 1 10.1.1.0 255.255.255.0
nat (inside) 1 10.1.2.0 255.255.255.0
nat (inside) 1 10.1.7.0 255.255.255.0
nat (inside) 1 10.1.8.0 255.255.255.0
nat (inside) 1 192.168.1.0 255.255.255.0
nat (inside) 1 192.168.20.0 255.255.255.0
nat (inside) 1 192.168.30.0 255.255.255.0
nat (inside) 1 10.100.0.0 255.255.0.0
nat (guest-access) 3 192.168.169.0 255.255.255.0
static (inside,outside) tcp interface https 10.1.1.42 https netmask 255.255.255.255  dns
static (inside,outside) tcp interface 8080 10.100.3.10 8080 netmask 255.255.255.255
static (inside,outside) tcp interface 3389 10.1.1.20 3389 netmask 255.255.255.255
static (inside,outside) xx.xx.xx.220 10.1.1.17 netmask 255.255.255.255
static (inside,outside) yy.yy.216.214 10.1.1.27 netmask 255.255.255.255 dns
static (inside,outside) zz.zz.216.210 192.168.1.32 netmask 255.255.255.255 dns
access-group outside_in in interface outside
access-group inside_out in interface inside
access-group guest-access in interface guest-access
route outside 0.0.0.0 0.0.0.0 xx.xx.xx.217 1
route inside 10.1.1.0 255.255.255.0 10.100.0.1 1
route inside 10.1.2.0 255.255.255.0 10.100.0.3 1
route inside 10.1.7.0 255.255.255.0 10.100.0.3 1
route inside 10.1.8.0 255.255.255.0 10.100.0.3 1
route inside 10.100.0.0 255.255.0.0 10.100.0.1 1
route inside 192.168.1.0 255.255.255.0 10.100.0.1 1
route inside 192.168.20.0 255.255.255.0 10.100.0.3 1
route inside 192.168.30.0 255.255.255.0 10.100.0.3 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server RADIUS protocol radius
aaa-server RADIUS (inside) host 10.1.1.14
 key *****
http server enable
http 10.1.8.128 255.255.255.255 inside
snmp-server host inside 10.1.1.14 poll community *****
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh 10.1.8.128 255.255.255.255 inside
ssh timeout 5
console timeout 0
dhcpd dns 24.93.41.125 24.93.41.126
dhcpd ping_timeout 750
dhcpd domain mydomain.local
!
dhcpd address 192.168.169.50-192.168.169.250 guest-access
dhcpd enable guest-access
!
priority-queue outside
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 129.7.1.66 source outside prefer
ntp server 209.184.112.199 source outside prefer
ntp server 192.5.41.209 source outside prefer
ssl trust-point localtrust outside
webvpn
 port 444
 enable outside
 dtls port 444
 svc image disk0:/anyconnect-win-3.1.03103-k9.pkg 1
 svc enable
 tunnel-group-list enable
group-policy SSLVPN_Client internal
group-policy SSLVPN_Client attributes
 dns-server value 10.1.1.32 10.1.1.14
 vpn-tunnel-protocol svc webvpn
 default-domain value xxx.com
 address-pools value SSLVPN_Client
 webvpn
  url-list none
  svc ask enable default webvpn timeout 10
group-policy IPSEC_VPN internal
group-policy IPSEC_VPN attributes
 dns-server value 10.1.1.14 10.1.1.32
 vpn-tunnel-protocol IPSec
 password-storage disable
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value IPSEC_VPN_splitTunnelAcl
 default-domain value ***.com
!
class-map Data2
class-map Voice
 match access-list 1
class-map all-other
 match access-list tcp-traffic
class-map inspection_default
 match default-inspection-traffic
class-map Data
 match tunnel-group xx.xx.xx.214
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 1024
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
  inspect pptp
policy-map Voicepolicy
 class Voice
  priority
 class Data
 class Data2
 class all-other
  police output 19500000
!
service-policy global_policy global
service-policy Voicepolicy interface outside
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:d0c626b4c84c07f131a329fbd87d5a76
: end

Post the ASA config (sanitized). Make sure you have applied the correct access list in the right direction. — Ron Trunk, May 8, 2018 at 17:15
The ASA config has been added to the original post. The access lists do appear to be applied in the correct direction. — heiwa, May 8, 2018 at 17:57
The only reason I can see is that your IP addresses aren't what you think they are. You can use the packet capture feature to capture packets on the outside interface to see that the addresses are what you think they are. — Ron Trunk, May 8, 2018 at 18:51
219 is the guest-access NAT address. You have no inbound service mapped to it. Webvpn is likewise not setup to use 219, and is running on port 444 of 218. — Ricky, May 8, 2018 at 20:01
Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https. This has solved my problem. — heiwa, May 9, 2018 at 23:16

heiwa · Accepted Answer · 2018-05-09 23:17:27Z

2

Thank you both for your input. I removed the global nat pool for xx.xx.xx.219, moved the web server being hosted at xx.xx.xx.218 to 219, and changed the webvpn port to 443 for standard https on 218. This has solved my problem.

answered May 9, 2018 at 23:17

heiwa

515 bronze badges

1

You should accept your answer so that the question doesn't keep popping up forever, looking for an answer.
– Ron Maupin ♦
May 10, 2018 at 0:12

Add a comment |

user3629081 · Accepted Answer · 2018-05-10 17:41:01Z

It is not supported to have the ASA respond to VPN tunnels on an IP address other than its own IP address. (This is in contrast to Cisco routers where you can do that.) So you would never be able to get this to work. You could, however, use a different port on the .218 IP address for WebVPN.

However, in regards to the packet tracer output, it was saying "drop" because it knew that the destination IP address lived out the same interface that the packet entered from, and the default behavior of an ASA is to not hairpin traffic. Therefore, it claims to drop it. If you have the command same-security-traffic permit intra-interface and you also had an outside ACL that permitted it, the ASA would be willing to hairpin the traffic back out and the packet tracer would say allow.

But, this still would not get the ASA to terminate WebVPN connections on an IP address other than its own.

Stack Exchange Network

Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL

2 Answers 2

Your Answer

Not the answer you're looking for? Browse other questions tagged
cisco-asa
network-access
access-control
or ask your own question.

Hot Network Questions

Cisco ASA 5510 implicit deny dropping traffic despite permit any ACL

2 Answers 2

Your Answer

Sign up or log in

Post as a guest

Not the answer you're looking for? Browse other questions tagged cisco-asanetwork-accessaccess-control or ask your own question.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
cisco-asa
network-access
access-control
or ask your own question.