0

I'm configuring a brand new ASA and the Firewall refuses to communicate on my inside interface.

No matter the traffic type, its denied by implicit deny every time. I was hoping to get some feedback/advice on how to resolve this.

Below is the setup/config:

Router | 10.0.4.253 vlan 300| -------- ASA | 10.0.4.254 vlan 300|

ASA interface config and ACL:

 interface GigabitEthernet1/2
  no nameif
  security-level 100
  no ip address

 interface GigabitEthernet1/2.2
  vlan 300
  nameif inside
  security-level 100
  ip address 10.0.4.254 255.255.255.252

   access-list inside_access_in extended permit ip any any
   access-list inside_access_in extended permit icmp any any
   access-list inside_access_out extended permit ip any any
   access-list inside_access_out extended permit icmp any any
   access-group inside_access_in in interface inside
   access-group inside_access_out out interface inside

  # packet-tracer input inside icmp 10.0.4.254 8 0 10.0.4.253 detailed

   Phase: 1
   Type: ROUTE-LOOKUP
   Subtype: Resolve Egress Interface
   Result: ALLOW
   Config:
   Additional Information:
   found next-hop 10.0.4.253 using egress ifc  inside

   Phase: 2
   Type: ACCESS-LIST
   Subtype:
   Result: DROP
   Config:
   Implicit Rule
   Additional Information:
    Forward Flow based lookup yields rule:
    in  id=0x7f1a5004b610, priority=501, domain=permit, deny=true
    hits=5, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
    src ip/id=10.0.4.254, mask=255.255.255.255, port=0, tag=any
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
    input_ifc=inside, output_ifc=any

   Result:
   input-interface: inside
   input-status: up
   input-line-status: up
   output-interface: inside
   output-status: up
   output-line-status: up
   Action: drop
   Drop-reason: (acl-drop) Flow is denied by configured rule

Im not sure why this is immediately dropping? I have a tcpdump listener in between, and the interface sends 0 packets, no arp, nothing.

When my router tries the ping i see the arp requested on the listener with no replies:

   10:16:17.018288 ARP, Request who-has 10.0.4.254 tell 10.0.4.253, length 46
  • There's a separate command (I forget what it is off the top of my head) you need to allow ICMP. – Ron Trunk Oct 15 '20 at 17:37
  • @RonTrunk Are you thinking of the deprecated command "fixup icmp"? – Jesse P. Oct 16 '20 at 0:40
  • @JesseP. No. It’s ICMP inspection, or something like that – Ron Trunk Oct 16 '20 at 2:11
  • @RonTrunk Yep. That's what the fixup command did. It was just a shortcut to adding the icmp inspection to the policy-map/class-map definitions. The command was "fixup protocol icmp". You can manually add the same configurations to the policy-map/class-map directly, though. I don't think the fixup command works at all in some of the newer code levels. – Jesse P. Oct 16 '20 at 2:51
  • At any rate, @fizgriz, if you can post the output of show run policy-map that should tell us what we need to know about which protocols you're currently inspecting. Better yet, if you can post the full sanitized config, it will help make sure we have all of the pieces we might need. – Jesse P. Oct 16 '20 at 2:55
0

Traffic sourced or received from the ASA is not subject to regular ACLs you would also need ICMP allow entries in place.

Example:

icmp permit host 10.0.4.253 echo-reply inside

icmp permit host 10.0.4.253 echo inside

If other traffic is entering and exiting the same zone you would also need a statement to allow intrazone traffic which is disabled by default.

same-security-traffic permit intra-interface

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.