12-03-2009 01:12 PM - edited 03-11-2019 09:45 AM
Hello all,
I am looking for some help. This is a strange one. My ASA5510 (ver 8.2(1)) works fine with other web site. But for some reason, we cannot access a website called: http://scrumforteamsystem.com/
I can access from my other location using PIX525 and outside of my network.
I did trace route, it looks like the destination unreachable from inside of my network. But if do a trace route from outside of network, it does the same thing.
Here is "sh conn" or "sh local-host" with saA error message.
TCP att 152.62.108.17:80 Inside 172.25.2.119:3691, idle 0:00:10, bytes 0, flags saA
But my question is why outside of my network can access the web site but we cannot even has the same issue "destination unreachable"? How do I fix the problem?
really thank you for all your help!
GP
12-03-2009 01:37 PM
TCP att 152.62.108.17:80 Inside 172.25.2.119:3691, idle 0:00:10, bytes 0, flags saA
Flags: A - awaiting inside ACK to SYN, a - awaiting outside ACK to SYN,
B - initial SYN from outside, b - TCP state-bypass or nailed, C - CTIQBE media,
D - DNS, d - dump, E - outside back connection, F - outside FIN, f - inside FIN,
G - group, g - MGCP, H - H.323, h - H.225.0, I - inbound data,
i - incomplete, J - GTP, j - GTP data, K - GTP t3-response
k - Skinny media, M - SMTP data, m - SIP media, n - GUP
O - outbound data, P - inside back connection, p - Phone-proxy TFTP connection,
q - SQL*Net data, R - outside acknowledged FIN,
R - UDP SUNRPC, r - inside acknowledged FIN, S - awaiting inside SYN,
s - awaiting outside SYN, T - SIP, t - SIP transient, U - up,
V - VPN orphan, W - WAAS,
X - inspected by service module
saA means that the host on the inside is waiting for a syn ack from the outside host. The webserver isn't responding back. The logs would problem say syn timeout.
When you say you are able to load the same site from the outside, what IP address are you looking like when you access this same website from the outside? Take that same IP address and use that to translate the inside host on the firewall and try to access the same page and see if it works.
-KS
12-03-2009 01:59 PM
Hello KS,
Really appreciate for your reply.
Basically I did not the ip address for the testing; I was using the DNS name of the website for the test and it translate to the same IP address. (it also showed up the same IP public ip addresses in both firewalls ASA5510 and PIX).
1. the following is the a trace from the location has saA error message:
H:\>tracert www.scrumforteamsystem.com
Tracing route to www.scrumforteamsystem.com [152.62.108.17]
over a maximum of 30 hops:
1 <1 ms <1 ms <1 ms
2 1 ms 1 ms 1 ms
3 1 ms <1 ms <1 ms 12.91.194.85
4 2 ms 1 ms 1 ms cr84.cgcil.ip.att.net [12.122.132.226]
5 2 ms 1 ms 1 ms cr2.cgcil.ip.att.net [12.123.7.250]
6 1 ms 1 ms 1 ms ggr3.cgcil.ip.att.net [12.122.132.9]
7 1 ms 1 ms 1 ms 192.205.34.206
8 77 ms 3 ms 213 ms te3-4.mpd01.ord03.atlas.cogentco.com [154.54.3.2
34]
9 69 ms 217 ms 2 ms te2-4.mpd01.ord01.atlas.cogentco.com [154.54.6.2
05]
10 165 ms 193 ms 27 ms te9-2.mpd03.jfk02.atlas.cogentco.com [154.54.29.
162]
11 103 ms 103 ms 103 ms te3-2.mpd02.lon01.atlas.cogentco.com [66.28.4.19
0]
12 112 ms 112 ms 112 ms te3-8.ccr01.lon01.atlas.cogentco.com [130.117.1.
133]
13 121 ms 121 ms 121 ms te1-2.ccr01.dub01.atlas.cogentco.com [130.117.0.
130]
14 122 ms 122 ms 122 ms 149.6.4.158
15 112 ms 112 ms 112 ms ge6-3.sw002.cwt.esat.net [193.95.131.70]
16 111 ms 111 ms 111 ms vlan54.sw502.cwt.esat.net [193.95.130.162]
17 111 ms 111 ms 111 ms ge5-2.sw532.cwt.esat.net [193.95.137.35]
18 emc-gw.cr532.cwt.esat.net [193.120.29.182] reports: Destination net unreac
hable.
Trace complete.
2. this trace is from the location can view the website:
C:\Users>tracert www.scrumforteamsystem.com
Tracing route to www.scrumforteamsystem.com [152.62.108.17]
over a maximum of 30 hops:
1 2 ms <1 ms 1 ms
2 1 ms <1 ms <1 ms core3.te2-2-bbnet2.chg.pnap.net [64.94.32.67]
3 1 ms <1 ms <1 ms GigabitEthernet5-0.GW1.CHI13.ALTER.NET [157.130.
102.245]
4 1 ms <1 ms <1 ms 0.so-6-2-0.XL4.CHI13.ALTER.NET [152.63.69.182]
5 27 ms 27 ms 28 ms 0.so-3-0-0.IL4.NYC9.ALTER.NET [152.63.23.177]
6 27 ms 27 ms 26 ms so-1-0-0.IL2.NYC12.ALTER.NET [146.188.15.1]
7 112 ms 112 ms 112 ms so-1-0-0.XT1.DUB2.ALTER.NET [146.188.15.105]
8 112 ms 112 ms 105 ms gigabitethernet8-0-0.gw5.dub2.alter.net [158.43.
152.39]
9 * * 212.120.129.182 reports: Destination net unreachable.
Trace complete.
I don't understand why both destinations are unreachable but one can see and another cannot. It looks like the first traceroute is a routing or BGP peering issue. But I don't understand why the second one is working.
KS, also I don't understand what do you want me to test? You mentioned "Take that same IP address and use that to translate the inside host on the firewall and try to access the same page and see if it works."
thanks again for all your help!
GP
12-03-2009 02:49 PM
Now, this is traceroute through the firewall. That is completely diff from not being able to access the website.
You need to allow traceroute through the firewall. Pls. check this link and add the necessary inspection and allow icmp time exceeded and unreachable to come back in for trace to complete.
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094e8a.shtml
Coming to what I was asking you to try is this.
1. You mentioned you were able to access the website by name on the outside correct? You were uisng a pc or laptop for this test. What IP address did you give this laptop? Some public IP address correct? I suggested to use the same IP address on the firewall to translate the inside host and see if the same website works. For example on the inside host behind the firewall if you were to go to http://ipchicken.com it should show you the same IP address that you gave the PC/laptop to test from the outside.
2. It appears like the website on the internet selectively responds back to certain IP addresses but not to others. We have seen cases like this.
Give that a shot and let me know.
-KS
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide