Solved

ASA DMZ access problems / Packet tracer

Posted on 2014-02-12
5
1,191 Views
Last Modified: 2014-02-19
I'm trying unsuccessfully to establish an http connection from inside host 5.6.7.80 to DMZ host 1.2.3.31.  To troubleshoot the problem I've attempted to use the packet tracer tool (Also unsuccessfully) - the packet tracer tool seems to indicate that this traffic would be allowed when in fact it is not allowed.  Am I using this tool correctly?  Is there another way to troubleshoot these dropped packets?  (See below for packet trace results)

ASA# packet-tracer input inside tcp 5.6.7.80 1024 1.2.3.31 80


Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   1.2.3.0   255.255.255.0   dmz

Phase: 3
Type: UN-NAT
Subtype: static
Result: ALLOW
Config:
nat (inside,dmz) source static Internal-Nets Internal-Nets destination static dmz-net dmz-net no-proxy-arp route-lookup
Additional Information:
NAT divert to egress interface dmz
Untranslate 1.2.3.31/80 to 1.2.3.31/80

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_out in interface inside
access-list inside_access_out extended permit ip any any
Additional Information:

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,dmz) source static Internal-Nets Internal-Nets destination static dmz-net dmz-net no-proxy-arp route-lookup
Additional Information:
Static translate 5.6.7.80/1024 to 5.6.7.80/1024

Phase: 6
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: FILTER
Subtype: filter-url
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside,dmz) source static Internal-Nets Internal-Nets destination static dmz-net dmz-net no-proxy-arp route-lookup
Additional Information:

Phase: 10
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:

Phase: 11
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 12
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 29559213, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: dmz
output-status: up
output-line-status: up
Action: allow

Open in new window


FYI - this is ASA software version 9.
0
Comment
Question by:tballin
  • 3
  • 2
5 Comments
 
LVL 15

Expert Comment

by:Robert Sutton Jr
ID: 39853855
Can you post a sanitized version of your config here please? Let us know.
0
 

Author Comment

by:tballin
ID: 39854006
There's a lot of config here and sanitizing it would take me all day - is there a portion of the config maybe that I could post for you?
0
 
LVL 15

Expert Comment

by:Robert Sutton Jr
ID: 39854159
The inside host, dmz host, Nat, and ACL portion would be good for starters.
0
 

Accepted Solution

by:
tballin earned 0 total points
ID: 39859164
Turns out it was a problem with the host, and not the firewall.  Thanks for the help though.
0
 

Author Closing Comment

by:tballin
ID: 39869808
Not the problem I thought it was.
0

Featured Post

Control application downtime with dependency maps

Visualize the interdependencies between application components better with Applications Manager's automated application discovery and dependency mapping feature. Resolve performance issues faster by quickly isolating problematic components.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

We sought a budget ($5,000) firewall solution that would provide all the performance we needed with no single point of failure.  Hosting a SAAS web application in our datacenter, it was critical that we find a way to keep connectivity up and inbound…
Network traffic routing plays key role in your network, if you have single site with heavy browsing or multiple sites, replicating important application data from your Primary Default Gateway ,you have to route your other network traffic from your p…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

910 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

21 Experts available now in Live!

Get 1:1 Help Now