ASA Packet Tracer

Unanswered Question
Jun 20th, 2010

Whenever I use the Packet Tracer in ASDM, I receive Flow is denied by configured rule. But I have rules that allow traffic to go from src - any and any - dst

Why would it do that?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
edadios Sun, 06/20/2010 - 17:22

Configured rule include inspections, rpf, and other firewall security function (like accelerated security path).

http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/s2.html#wp1351326

It will be good to look at the overall steps the traffic flow took, and from there, kind of determine, which step previous or  next, that may have contributed to the packet being deny.

You may have configured acl to allow source to a destination, but then, the flow may take a different path, due to a misconfigured/conflicted NAT, and result in the deny of the flow.

Regards,

gatlin007 Mon, 06/21/2010 - 14:31

The ASA packet tracer is a nice feature, but syslog is a much better diagnostic tool in determining what is preventing functionally.

Chris

Actions

This Discussion