Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win


Problem with ASA connection

Posted on 2010-09-20
Medium Priority
Last Modified: 2012-05-10
   I am having issue with a new installation of asa 5520. My outside routers
are running bgp the bgp traffic from my outside routers goes through my production firewall to vlan hosting the routers to the dr site then out to the dr to the dr routers who are part of the bgp process. So basically the bgp protocol traffic goes through the production firewall i am getting the following error

The traffic is been blocked

2              Sep 20 2010      10:21:34      106001      11271      179      Inbound TCP connection denied from to flags SYN  on interface OUTSIDE

looks to me like a simple allow rule to me . I have gone as far as allowing ip any any on the outside interface still not working .

ANy ideas If i do not get them up soon i am going have to roll back so any help would be greatly appreciated.

Question by:BarepAssets
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 18

Accepted Solution

jmeggers earned 2000 total points
ID: 33715109
You need to take a look at http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009487d.shtml.

You have to explicitly permit tcp 179 from the outside, but if you're doing MD5 it gets more complicated, and
you also have to disable the random sequencing of the BGP connection.  In older code you did this by using the "norandomseq" parameter on a static NAT config:

static (inside,outside) netmask norandomseq

With ASA 7.x code and later, you handle this a different way, shown at the bottom of the link I sent you.

Author Comment

ID: 33716915
thanx jmeggers

i have tried the above still not working  the following is the code i have successifully put into to the config of the asa i am on ios 8.3.2(1)

access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
  tcp-options range 19 19 allow

class-map CLASS-BGP-MD5
 match access-list BGP-MD5-ACL
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
 class CLASS-BGP-MD5
  set connection random-sequence-number disable
  set connection advanced-options BGP-MD5-OPTION-ALLOW
service-policy global_policy global

is the access-list for the outside interface allowing is also been put in
LVL 18

Expert Comment

ID: 33721366
Unfortunately I haven't worked with 8.3 code yet, so I'm at a disadvantage here. I know 8.3 introduced changes in how NAT is handled, but from the config you show, it looks like you're not doing NAT.  Can I assume the ASA is in routed (layer 3) mode?  I have to go now, will try to find some more pointers on troubleshooting when I get back.

Author Comment

ID: 33721433
cheers jmeggers i resolved the 2nd part of it basically it was same-security interface we have additional vlan connected to firewall with the router to the dr site  these were set to the same security level i will give you the full points as i think would have ran into issue not having added the bgp md5 policy map anyway think was two fold solutiion yes  nat has changed loads :( found this part of the upgrade hardest just trying get use to the new nat will just takes some getting use to thx again for your help
LVL 18

Expert Comment

ID: 33723794
That's a perfect example of why attaching only portions of the config doesn't always help.  I probably wouldn't have thought to ask that question unless I could see all the configuration.  Good job on solving the problem, though.

Featured Post

What does it mean to be "Always On"?

Is your cloud always on? With an Always On cloud you won't have to worry about downtime for maintenance or software application code updates, ensuring that your bottom line isn't affected.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Concerto Cloud Services, a provider of fully managed private, public and hybrid cloud solutions, announced today it was named to the 20 Coolest Cloud Infrastructure Vendors Of The 2017 Cloud  (http://www.concertocloud.com/about/in-the-news/2017/02/0…
This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

610 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question