0

Below is the output of packet tracer. I have simulated a ping packet from 10.106.51.203 to 10.106.51.200. 'mgmt' is supposed to be the outside interface. Also, why is output-interface in the result section says inside?

Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
  in  id=0x7fb2f9993a60, priority=0, domain=permit, deny=true

    hits=9127, user_data=0x0, cs_id=0x0, reverse, flags=0x1000, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=any
    dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=any, dscp=0x0
    input_ifc=mgmt, output_ifc=any


Result:
input-interface: mgmt
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
  • 2
    You need to post your ASA config (sanitized). There are too many possibilities. – Ron Trunk Feb 14 at 16:57
  • ...the full packet-tracer command would help, too – jimbobmcgee Feb 14 at 18:44
  • Also, are you sure mgmt is supposed to the outside interface? What's the interface ID that has nameif mgmt? If it is Management0 (or similar) then it probably has management-only defined as part of its config, which will stop traffic passing through to another interface, by design. – jimbobmcgee Feb 14 at 19:57
  • Thank you all.. The problem was that a NAT statement blocking the packet flow. – P_K Feb 15 at 2:04
  • @jimbobmcgee It is an outside interface, for sure – P_K Feb 15 at 2:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.