Problem with ASA connection

Posted on 2010-09-20
Last Modified: 2012-05-10
   I am having issue with a new installation of asa 5520. My outside routers
are running bgp the bgp traffic from my outside routers goes through my production firewall to vlan hosting the routers to the dr site then out to the dr to the dr routers who are part of the bgp process. So basically the bgp protocol traffic goes through the production firewall i am getting the following error

The traffic is been blocked

2              Sep 20 2010      10:21:34      106001      11271      179      Inbound TCP connection denied from to flags SYN  on interface OUTSIDE

looks to me like a simple allow rule to me . I have gone as far as allowing ip any any on the outside interface still not working .

ANy ideas If i do not get them up soon i am going have to roll back so any help would be greatly appreciated.

Question by:BarepAssets
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
  • 2
LVL 18

Accepted Solution

jmeggers earned 500 total points
ID: 33715109
You need to take a look at

You have to explicitly permit tcp 179 from the outside, but if you're doing MD5 it gets more complicated, and
you also have to disable the random sequencing of the BGP connection.  In older code you did this by using the "norandomseq" parameter on a static NAT config:

static (inside,outside) netmask norandomseq

With ASA 7.x code and later, you handle this a different way, shown at the bottom of the link I sent you.

Author Comment

ID: 33716915
thanx jmeggers

i have tried the above still not working  the following is the code i have successifully put into to the config of the asa i am on ios 8.3.2(1)

access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
access-list BGP-MD5-ACL extended permit tcp host host eq bgp
  tcp-options range 19 19 allow

class-map CLASS-BGP-MD5
 match access-list BGP-MD5-ACL
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
 class CLASS-BGP-MD5
  set connection random-sequence-number disable
  set connection advanced-options BGP-MD5-OPTION-ALLOW
service-policy global_policy global

is the access-list for the outside interface allowing is also been put in
LVL 18

Expert Comment

ID: 33721366
Unfortunately I haven't worked with 8.3 code yet, so I'm at a disadvantage here. I know 8.3 introduced changes in how NAT is handled, but from the config you show, it looks like you're not doing NAT.  Can I assume the ASA is in routed (layer 3) mode?  I have to go now, will try to find some more pointers on troubleshooting when I get back.

Author Comment

ID: 33721433
cheers jmeggers i resolved the 2nd part of it basically it was same-security interface we have additional vlan connected to firewall with the router to the dr site  these were set to the same security level i will give you the full points as i think would have ran into issue not having added the bgp md5 policy map anyway think was two fold solutiion yes  nat has changed loads :( found this part of the upgrade hardest just trying get use to the new nat will just takes some getting use to thx again for your help
LVL 18

Expert Comment

ID: 33723794
That's a perfect example of why attaching only portions of the config doesn't always help.  I probably wouldn't have thought to ask that question unless I could see all the configuration.  Good job on solving the problem, though.

Featured Post

Is your NGFW recommended by NSS Labs?

Ours is! NSS Labs Next Generation Firewall Test gives the WatchGuard Firebox M4600 a "Recommended" rating! Curious where your NGFW landed on the  Security Value Map? See the map and download the full report today!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
A 2007 NCSA Cyber Security survey revealed that a mere 4% of the population has a full understanding of firewalls. As business owner, you should be part of that 4% that has a full understanding.
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

688 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question