access list hit count

Unanswered Question
Sep 18th, 2008
User Badges:

Hi,

I am having some weird problem. we have configured access list for the applications on ASA outside interface. It is working also but I am not able to see any hit count on the access list. It increases only by one when a new session is initiated from outside world. If we continue to use that application hit count doesnt seem to increase. I checked in the command show conn detail it shows the connection established.

any related experience please share ?

Any link on cisco.com

thanks in advance

subodh

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
allissrcco Thu, 09/18/2008 - 04:22
User Badges:

Hi Bapatsubodh,


I have often wondered about this and I have come to the conclusion that the count only increments for each new session started. Hence once the session has been established further packets for this session do not increment the counter. If you disconnect the session and start a new one the counter will increment.


Does anyone else out there have an alternative explaination?


bapatsubodh Thu, 09/18/2008 - 07:35
User Badges:

Hi,

Allissrco,

Thanks for your feedback. This means I am not the only one who has seen this weird begaviour.

Please post if you have any other feedback

Thanks

Subodh Bapat

suschoud Thu, 09/18/2008 - 04:41
User Badges:
  • Gold, 750 points or more

When the connection is not established,access list and nat is checked.As soon as connection gets established,these checks are not performed any more.


That's why ,you would see a single hitcount.



Here is how pix/asa processes traffic :



1. Recieve Packet.

2. Existing Connection?

3. Permit by Inbound ACL on interface?

4. Match translation rule (nat, static).

5. NAT embedded IP and perform security checks / randomize sequence number.

6. NAT IP header.

7. Pass packet to outgoing interface.

8. Layer 3 route lookup?

9. Layer 2 next hop?

10. Transmit packet.




So,if there is an existing connection,f/w would transmit...no further checks.



Please rate if helpful.



Regards,

Sushil

Radim Jurica Wed, 03/04/2009 - 09:32
User Badges:

Excelent explanation!

I tried to find in docs when are hit counts deleted, except when I use clear command. Only during reboot ASA? And during fail over ? Or in any other situation?


Thank you!


Radim

Actions

This Discussion