I have a massive ACL that i'm dealing with and I can't seem to find what line is blocking me. Is there a way for packet-tracer to help me figure out more specifically where i'm getting blocked at?

packet-tracer input AAAA tcp 10.A.B.1 5555 10.C.D.80 PORT# d

Phase: 3
Subtype: input
Result: ALLOW
Additional Information:
in         AAAA

Phase: 4
Result: DROP
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7ffd9a7f9e40, priority=111, domain=permit, deny=true
        hits=28704780, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
        src ip/id=, mask=, port=0, tag=0
        dst ip/id=, mask=, port=0, tag=0 dscp=0x0
        input_ifc=AAAA, output_ifc=AAAA

input-interface: AAAA
input-status: up
input-line-status: up
output-interface: AAAA
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Some clues that I have gathered (not sure if they are correct though)

  • The drop reason indicates that a configured line is dropping the packet and not the default deny at the end
  • The packet is getting denied at the output ACL on interface AAAA
  • There is a id string and a hit counter but I don't know how to match that up with anything

2 Answers 2


Implicit Rule and AAAA being the in and out interface... That's called hair-pinning, and it's generally not allowed. It works on my asa, but I have the following enabled:

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
  • That makes sense but "same-security-traffic permit inter-interface" is enabled on this firewall, could the block be that the intra-interface isn't enabled?
    – evolvd
    Jan 20, 2014 at 20:54
  • @evolvd, yes. To allow traffic to enter and exit the same interface, you need the "intra-interface" statement (see here for more details). The "inter-interface" command allows traffic to enter and exit two different interfaces that have the same security level.
    – YLearn
    Sep 15, 2015 at 2:27

Cisco ASA (acl-drop) Flow is denied by configured rule



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.