ASA Packet Tracer

Unanswered Question
Jun 20th, 2010
User Badges:

Whenever I use the Packet Tracer in ASDM, I receive Flow is denied by configured rule. But I have rules that allow traffic to go from src - any and any - dst


Why would it do that?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
edadios Sun, 06/20/2010 - 17:22
User Badges:
  • Silver, 250 points or more

Configured rule include inspections, rpf, and other firewall security function (like accelerated security path).


http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s2.html#wp1351326


It will be good to look at the overall steps the traffic flow took, and from there, kind of determine, which step previous or  next, that may have contributed to the packet being deny.


You may have configured acl to allow source to a destination, but then, the flow may take a different path, due to a misconfigured/conflicted NAT, and result in the deny of the flow.


Regards,

gatlin007 Mon, 06/21/2010 - 14:31
User Badges:
  • Silver, 250 points or more

The ASA packet tracer is a nice feature, but syslog is a much better diagnostic tool in determining what is preventing functionally.



Chris

Actions

This Discussion