Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 667
  • Last Modified:

Problem with ASA connection

   I am having issue with a new installation of asa 5520. My outside routers
are running bgp the bgp traffic from my outside routers goes through my production firewall to vlan hosting the routers to the dr site then out to the dr to the dr routers who are part of the bgp process. So basically the bgp protocol traffic goes through the production firewall i am getting the following error

The traffic is been blocked

2              Sep 20 2010      10:21:34      106001      11271      179      Inbound TCP connection denied from to flags SYN  on interface OUTSIDE

looks to me like a simple allow rule to me . I have gone as far as allowing ip any any on the outside interface still not working .

ANy ideas If i do not get them up soon i am going have to roll back so any help would be greatly appreciated.

  • 3
  • 2
1 Solution
jmeggersSr. Network and Security EngineerCommented:
You need to take a look at http://www.cisco.com/en/US/tech/tk365/technologies_configuration_example09186a008009487d.shtml.

You have to explicitly permit tcp 179 from the outside, but if you're doing MD5 it gets more complicated, and
you also have to disable the random sequencing of the BGP connection.  In older code you did this by using the "norandomseq" parameter on a static NAT config:

static (inside,outside) netmask norandomseq

With ASA 7.x code and later, you handle this a different way, shown at the bottom of the link I sent you.
BarepAssetsAuthor Commented:
thanx jmeggers

i have tried the above still not working  the following is the code i have successifully put into to the config of the asa i am on ios 8.3.2(1)

access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
  tcp-options range 19 19 allow

class-map CLASS-BGP-MD5
 match access-list BGP-MD5-ACL
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
 class CLASS-BGP-MD5
  set connection random-sequence-number disable
  set connection advanced-options BGP-MD5-OPTION-ALLOW
service-policy global_policy global

is the access-list for the outside interface allowing is also been put in
jmeggersSr. Network and Security EngineerCommented:
Unfortunately I haven't worked with 8.3 code yet, so I'm at a disadvantage here. I know 8.3 introduced changes in how NAT is handled, but from the config you show, it looks like you're not doing NAT.  Can I assume the ASA is in routed (layer 3) mode?  I have to go now, will try to find some more pointers on troubleshooting when I get back.
BarepAssetsAuthor Commented:
cheers jmeggers i resolved the 2nd part of it basically it was same-security interface we have additional vlan connected to firewall with the router to the dr site  these were set to the same security level i will give you the full points as i think would have ran into issue not having added the bgp md5 policy map anyway think was two fold solutiion yes  nat has changed loads :( found this part of the upgrade hardest just trying get use to the new nat will just takes some getting use to thx again for your help
jmeggersSr. Network and Security EngineerCommented:
That's a perfect example of why attaching only portions of the config doesn't always help.  I probably wouldn't have thought to ask that question unless I could see all the configuration.  Good job on solving the problem, though.

Featured Post

The Lifecycle Approach to Managing Security Policy

Managing application connectivity and security policies can be achieved more effectively when following a framework that automates repeatable processes and ensures that the right activities are performed in the right order.

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now