×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Packet Tracer (Implicit Deny) issue

Answered Question
Dec 26th, 2013
User Badges:

Hello,


I am trying to do a simple packet tracer  on my ASA and this is what I am getting


ASA#       packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.0.6 22 xml

<Phase>
<id>1</id>
<type>ROUTE-LOOKUP</type>
<subtype>input</subtype>
<result>ALLOW</result>
<config>
</config>
<extra>
in   10.250.0.4      255.255.255.252 DMZ
</extra>
</Phase>

<Phase>
<id>2</id>
<type>ACCESS-LIST</type>
<subtype></subtype>
<result>DROP</result>
<config>
Implicit Rule
</config>
<extra>
</extra>
</Phase>

<result>     
<input-interface>DMZ</input-interface>
<input-status>up</input-status>
<input-line-status>up</input-line-status>
<output-interface>DMZ</output-interface>
<output-status>up</output-status>
<output-line-status>up</output-line-status>
<action>drop</action>
<drop-reason>(acl-drop) Flow is denied by configured rule</drop-reason>
</result>
ASA#


The 10.250.0.6 deve is a router directly connected to the DMZ interface 10.250.0.5


However I am getting the reason for droped packet as (Implicit Rule) which I can see is only on the global interface.


I am permiting ip any any on that same interface as well.

How can I make this work?

The reson for this is I need my ASA to authenticate with TACACS server which is behind the 10.250.0.6 router

Correct Answer by Collin Clark about 3 years 7 months ago

It's just strange that TACACS can't be ping'd, yet traffic through the ASA is good.


What type of device is 10.250.0.6? Do you have access to it?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (10 ratings)
Loading.
Mariusz Bochen Fri, 12/27/2013 - 02:54
User Badges:

Hi Kemal,


Reading your post 2 things came in to my mind:


1. Why you use /30 mask on your firewall? With this mask you have only 2 useable addresses. One you're going to use for the firewall interface IP, second one for the router.

2. Packet tracer with specified same source and destination network will always fail even if you allow all the traffic and enable same security traffic. Devices communicating within the same subnet will not hit the firewall.


Unless this is just a typo and you should just change the destination IP in the packet tracer? What is your TACACS IP ?



Regards

Mariusz

Kemal Zuko Fri, 12/27/2013 - 06:01
User Badges:

the reason I have a /30 between my ASA and my router is tat behind my router I have another IP scope for my LAN (10.250.100.128/25)


I am douing dynamic pat on the asa and the router for the workstations to get out

the ip address of the tacacs server is 10.250.100.142 I am getting the same packet tracer resoult with the other IP as well

Kemal Zuko Mon, 12/30/2013 - 20:04
User Badges:

Hello


yes the config is below...

The tow router behing DMZ and INSIDE interfaces on the ASA are able to authenticate against the tacaacs server


ASA Version 9.1(2)

!

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/0

shutdown    

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

!

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

!            

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

!

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http

https://tools.cisco.com/its/service/oddce/services/DDCEService


  destination address email

[email protected]


  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end

ASA Version 9.1(2)

!

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/0

shutdown    

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

!

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

!            

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

!

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService


  destination address email

[email protected]

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end


any suggestions?

Thanks

Mariusz Bochen Tue, 12/31/2013 - 03:38
User Badges:

Hi Kemal,


Sorry, but I have few more questions

Can you see the 10.250.100.128/25 network in the routing table (learned by eigrp)?

Are you able to ping the 10.250.100.142 from the ASA's DMZ interface?

Can you please post the result of

packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.100.142 22 ?


Regards

Mariusz

Kemal Zuko Tue, 12/31/2013 - 05:20
User Badges:

Hello Mariusz,


I can see the 10.250.100.128/25 network in my routing table via EIGRP


here are the resoults you have asked for


ASA# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 12:01:54, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 12:01:54, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    75.11.11.0 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 75.11.11.1, outside
ASA#     

ASA# ping 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)


ASA# ping DMZ 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASA#
ASA#


ASA#  traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

1   *  *  *
2   *  *  *
3   *  *


ASA#

ASA# packet-tracer input dmZ tcp 10.250.0.5 2234 10.250.100.142 22

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
             
Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

ASA# 



When I go to my ASDM and Under MOnitoring/Properties/AAA Servers I see the Tacacs Server configured but under status it says Failed.

here are some of the statistics of that screen


BiHTacTACACS+10.250.100.142Failed


Server port:  49

Number of pending requests  0

Average round trip time   0ms

Number of authentication requests 12

Number of authorization requests 19

Number of accounting requests  0

Number of retransmissions  0

Number of accepts   0

Number of rejects   0

Number of challenges   0

Number of malformed responses  0

Number of bad authenticators  0

Number of timeouts   31

Number of unrecognized responses 0



Also it would be worth mentioning that I can ping 10.250.0.5 (DMZ interface) of the ASA from the Tacacs Server


C:\Users\aaa>ping 10.250.0.5

Pinging 10.250.0.5 with 32 bytes of data:
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254


Ping statistics for 10.250.0.5:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms



C:\Users\aaa>tracert 10.250.0.5

Tracing route to 10.250.0.5 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  10.250.100.129
  2     1 ms     1 ms     1 ms  10.250.0.5


Trace complete.


Thanks

Collin Clark Tue, 12/31/2013 - 19:30
User Badges:
  • Purple, 4500 points or more

We can see that an ACL is dropping the traffic. Can you do another packet-tracer with detail?


packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Kemal Zuko Tue, 12/31/2013 - 20:20
User Badges:

Sure.. It looks like that it gets dropped by the Implicit Deny rule under Global


ASA# packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5774bbf0, priority=1, domain=permit, deny=false
        hits=39042567, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=DMZ, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:     
Result: DROP 
Config:      
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5775fdc0, priority=500, domain=permit, deny=true
        hits=1, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=10.250.0.5, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Collin Clark Tue, 12/31/2013 - 20:37
User Badges:
  • Purple, 4500 points or more

What are you seeing in the logs on your TACACS server? Do you see authentication attempts fromthe ASA?

Kemal Zuko Wed, 01/01/2014 - 06:33
User Badges:

No I dont see any requests from the 10.250.0.5 (DMZ) to the TACACS Server


here are the only two logs I see on my Tacacs


<94> 2014-01-01 08:11:58 [10.250.100.129:36682] New client connection opened for 10.250.100.15:13334 TID:11

<94> 2014-01-01 08:18:46 [10.250.100.15:13334] New client connection opened for 10.250.100.15:59242 TID:12


The 10.250.100.15 router is behind the 10.250.0.1 (inside interface)


Here is a packet tracer for that interface


ASA# packet-tracer input inside udp 10.250.100.15 2234 10.250.100.142 49 de$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any4 any4
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5828c890, priority=13, domain=permit, deny=false
        hits=27554, user_data=0x53100dc0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 3
Type: NAT    
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13320, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x57717078, priority=0, domain=inspect-ip-options, deny=true
        hits=28028, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any
             
Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in  id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13322, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in  id=0x57751878, priority=0, domain=inspect-ip-options, deny=true
        hits=18130, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 56599, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:      
input-interface: inside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: allow


And here is the traceroute from 10.250.100.15 to 10.250.100.142


WLAN_AP>traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

  1 10.250.100.1 0 msec 0 msec 0 msec
  2 10.250.0.6 0 msec 0 msec 0 msec
  3 10.250.100.142 8 msec 0 msec 0 msec


I am puzzeld on how the above device can talk to the Tacacs Server but my ASA DMZ interface cant even Ping it.

Collin Clark Wed, 01/01/2014 - 06:44
User Badges:
  • Purple, 4500 points or more

Can you try this-


Remove-

aaa-server BiHTac (DMZ) host 10.250.100.142



Add-

aaa-server BiHTac (inside) host 10.250.100.142

key ********

Kemal Zuko Wed, 01/01/2014 - 07:07
User Badges:

Negative

I now cant even log in using my local database


aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (inside) host 10.250.100.142

key *****

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 inside

http 10.250.0.2 255.255.255.255 inside


ssh 10.250.100.140 255.255.255.255 inside

ssh 10.250.0.2 255.255.255.255 inside

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

Collin Clark Wed, 01/01/2014 - 07:12
User Badges:
  • Purple, 4500 points or more

When it was set to (DMZ) you were also using local creds to get in correct?

Kemal Zuko Wed, 01/01/2014 - 07:13
User Badges:

correct,


now I cant get in via ssh or http on inside interface

The only access I have is via console

      


I removed the ssh and http configuration for DMZ

Collin Clark Wed, 01/01/2014 - 07:28
User Badges:
  • Purple, 4500 points or more

Go ahead and change it back to (DMZ). Can you enable debug for TACACS and post some of the debug?

Kemal Zuko Wed, 01/01/2014 - 07:45
User Badges:

here is what I see


%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authentication request for user kzuko : Auth-server group BiHTac unreachable

%ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = kzuko

%ASA-6-611102: User authentication failed: Uname: kzuko

%ASA-6-611102: User authentication failed: Uname: kzuko

%ASA-6-315011: SSH session from 10.250.0.6 on interface DMZ for user "kzuko" disconnected by SSH server, reason: "Internal error" (0x00)

%ASA-6-302014: Teardown TCP connection 61690 for DMZ:10.250.0.6/54569 to identity:10.250.0.5/22 duration 0:00:07 bytes 1347 TCP FINs

Kemal Zuko Wed, 01/01/2014 - 07:48
User Badges:

Sorry Wrong log


here is the debug


%ASA-6-302013: Built outbound TCP connection 61851 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/31091 (10.250.0.1/31091)
%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/31091 to inside:10.250.100.142/49
mk_pkt - type: 0x2, session_id: 315
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging cmd-arg=console  Tacacs packet sent
%ASA-6-302014: Teardown TCP connection 61851 for inside:10.250.100.142/49 to identity:10.250.0.1/31091 duration 0:00:00 bytes 0 No valid adjacency
Sending TACACS Authorization message. Session id: 315, seq no:1
%ASA-6-302013: Built outbound TCP connection 61852 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/52801 (10.250.0.1/52801)
TACACS Request timed out
TACACS Session finished. Session id: 315, seq no: 1

mk_pkt - type: 0x2, session_id: 316
mkpkt - authorize user: bihadmin
cmd=no
%ASA-6-302014: Teardown TCP connection 61852 for inside:10.250.100.142/49 to identity:10.250.0.1/52801 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=logging cmd-arg=console  Tacacs packet sent
Sending TACACS Authorization message. Session id: 316, seq no:1
%ASA-6-302013: Built outbound TCP connection 61853 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/28448 (10.250.0.1/28448)
TACACS Request timed out
TACACS Session finished. Session id: 316, seq no: 1

mk_pkt - type: 0x2, session_id: 317
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging %ASA-6-302014: Teardown TCP connection 61853 for inside:10.250.100.142/49 to identity:10.250.0.1/28448 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=console  Tacacs packet sent
Sending TACACS Authorization message. Session id: 317, seq no:1
%ASA-2-113022: AAA Marking TACACS+ server 10.250.100.142 in aaa-server group BiHTac as FAILED
BIHASA(config)# TACACS Request timed out
TACACS Session finished. Session id: 317, seq no: 1

Collin Clark Wed, 01/01/2014 - 07:58
User Badges:
  • Purple, 4500 points or more

Big help, thanks.


%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/31091 to inside:10.250.100.142/49


Can you post another show route?

Kemal Zuko Wed, 01/01/2014 - 08:03
User Badges:

ASA(config)# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 38:50:54, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 38:50:44, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 38:50:54, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 38:50:44, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    75.132.0.0 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 75.132.0.1, outside

Collin Clark Wed, 01/01/2014 - 08:11
User Badges:
  • Purple, 4500 points or more

The routing looks good. In your TACACS server, what IP is configured as the host? The ASA's DMZ address?

Collin Clark Wed, 01/01/2014 - 08:13
User Badges:
  • Purple, 4500 points or more

Can we try and put a host specific route in for the TACACS server?


route DMZ 10.250.100.142 255.255.255.255 10.250.0.6


Then check the debug log again.

Kemal Zuko Wed, 01/01/2014 - 08:27
User Badges:

Ok did that but still nothing


I am also not seeng much in the debug


sh debug  tacacs

%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authorization request for user bihadmin : Auth-server group BiHTac unreachable

debug tacacs session

ASA(config)# %ASA-7-111009: User 'bihadmin' executed cmd: show debug tacacs


I got debug tacacs and debug tacacs session running on logging console debugging

Kemal Zuko Wed, 01/01/2014 - 08:46
User Badges:

ok I have noticed that these error loggs come in very late. I got this error log below 5 min later


%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63066 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/6622 (10.250.0.1/6622)
%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/6622 to inside:10.250.100.142/49
mk_pkt - type: 0x2, session_id: 332
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug cmd-arg=tacacs  Tacacs packet sent
%ASA-6-302014: Teardown TCP connection 63066 for inside:10.250.100.142/49 to identity:10.250.0.1/6622 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
Sending TACACS Authorization message. Session id: 332, seq no:1
%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63067 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/46116 (10.250.0.1/46116)
TACACS Request timed out
TACACS Session finished. Session id: 332, seq no: 1

mk_pkt - type: 0x2, session_id: 333
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug %ASA-6-302014: Teardown TCP connection 63067 for inside:10.250.100.142/49 to identity:10.250.0.1/46116 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
cmd-arg=tacacs  Tacacs packet sent
Sending TACACS Authorization message. Session id: 333, seq no:1
%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63068 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/47263 (10.250.0.1/47263)
TACACS Request timed out
TACACS Session finished. Session id: 333, seq no: 1

mk_pkt - type: 0x2, session_id: 334
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug %ASA-6-302014: Teardown TCP connection 63068 for inside:10.250.100.142/49 to identity:10.250.0.1/47263 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
cmd-arg=tacacs  Tacacs packet sent
Sending TACACS Authorization message. Session id: 334, seq no:1
%ASA-2-113022: AAA Marking TACACS+ server 10.250.100.142 in aaa-server group BiHTac as FAILED
debug tacacs session
TACACS Request timed out
%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authorization request for user bihadmin : Auth-server group BiHTac unreachable
%ASA-7-111009: User 'bihadmin' executed cmd: show debug tacacs
BIHASA(config)# TACACS Session finished. Session id: 334, seq no: 1

%ASA-6-305012: Teardown dynamic UDP translation from inside:10.250.100.4/52561 to outside:75.1.1.1/52561 duration 0:00:31

Kemal Zuko Wed, 01/01/2014 - 08:53
User Badges:

I have also noticred this


%ASA-6-302013: Built outbound TCP connection 63066 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/6622 (10.250.0.1/6622)


It mentions "inside" the 10.250.100.142 is behind the DMZ


ok... for some reason it didint take my last commands when I was putting it back on to the DMZ


Lets try the debug again

Kemal Zuko Wed, 01/01/2014 - 09:12
User Badges:

Nothing no debug loggs this time when I try to connect

Kemal Zuko Wed, 01/01/2014 - 10:05
User Badges:

sometimes I see this


mk_pkt - type: 0x2, session_id: 370
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 370, seq no:1
TACACS Request Timed out. Session id: 370, seq no:1
mk_pkt - type: 0x2, session_id: 371
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 371, seq no:1
TACACS Session finished. Session id: 370, seq no: 1

TACACS Request Timed out. Session id: 371, seq no:1
mk_pkt - type: 0x2, session_id: 372
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 372, seq no:1
TACACS Session finished. Session id: 371, seq no: 1

TACACS Request Timed out. Session id: 372, seq no:1
TACACS Session finished. Session id: 372, seq no: 1

mk_pkt - type: 0x2, session_id: 373
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 373, seq no:1
TACACS Request Timed out. Session id: 373, seq no:1
mk_pkt - type: 0x2, session_id: 374
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 374, seq no:1
TACACS Session finished. Session id: 373, seq no: 1

TACACS Request Timed out. Session id: 374, seq no:1
mk_pkt - type: 0x2, session_id: 375
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 375, seq no:1
TACACS Session finished. Session id: 374, seq no: 1

TACACS Request Timed out. Session id: 375, seq no:1
TACACS Session finished. Session id: 375, seq no: 1

Collin Clark Wed, 01/01/2014 - 14:31
User Badges:
  • Purple, 4500 points or more

I saw that too and that's what made me think it could be a routing issue. Can you do another packet-tracer?


packet-tracer input DMZ udp 10.250.0.5 49 10.250.100.142 49 detail

Kemal Zuko Wed, 01/01/2014 - 14:47
User Badges:

yea, I am not sure how it cant see host but knows about it in the routing table


Packet tracer result


BIHASA# packet-tracer input DMZ udp 10.250.0.5 49 10.250.100.142 49 detail

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5774bbf0, priority=1, domain=permit, deny=false
        hits=39266356, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=DMZ, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.142  255.255.255.255 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:     
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5775fdc0, priority=500, domain=permit, deny=true
        hits=4, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=10.250.0.5, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Collin Clark Wed, 01/01/2014 - 14:50
User Badges:
  • Purple, 4500 points or more

Can you try this one too?


packet-tracer input DMZ udp 10.250.0.1 49 10.250.100.142 49 detail

Kemal Zuko Wed, 01/01/2014 - 15:08
User Badges:

BIHASA# packet-tracer input DMZ udp 10.250.0.1 49 10.250.100.142 49 detail

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.142  255.255.255.255 DMZ

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5774dd08, priority=111, domain=permit, deny=true
        hits=1, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=DMZ

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Collin Clark Wed, 01/01/2014 - 15:26
User Badges:
  • Purple, 4500 points or more

Thanks. I'm curious on the next hop. Can you try-


traceroute 10.250.100.142

Kemal Zuko Wed, 01/01/2014 - 15:37
User Badges:

yea it dosent go anywhere


BIHASA# traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

1   *  *  *
2   *  *  *
3   *  *

Kemal Zuko Wed, 01/01/2014 - 15:43
User Badges:

What do you think about this... I have an extra PC that I can setup the tacacs server on and connect it directly to Gi0/2 on like a 10.250.101.0/30 but I am not sure if this would help us in this case?

Correct Answer
Collin Clark Wed, 01/01/2014 - 16:11
User Badges:
  • Purple, 4500 points or more

It's just strange that TACACS can't be ping'd, yet traffic through the ASA is good.


What type of device is 10.250.0.6? Do you have access to it?

Kemal Zuko Wed, 01/01/2014 - 16:16
User Badges:

.6 is a cisco 1800 series router

Yes I have access to it

      


Sh Run


logging buffered 1000000 informational

logging reload debugging

logging rate-limit console 5

no logging console

enable secret 5 $1$tcXv$wtK8ERTYUIO_)(*&%^&*(DovQnfMYwcuCQ0LjX1

!

aaa new-model

!

!

aaa group server tacacs+ BiHTac

server 10.250.100.142

!

aaa authentication login BiHTac group BiHTac local

aaa authentication enable default group BiHTac enable

aaa authorization commands 15 BiHTac group BiHTac if-authenticated

aaa accounting exec BiHTac

action-type start-stop

group BiHTac

!

!

!

!

!

!

aaa session-id common

!

!

!

dot11 syslog

ip source-route

!        

!

!

!

ip cef

no ip domain lookup

!

multilink bundle-name authenticated

!

!

key chain BIHAUTH

key 99

  key-string 7 1435411234567890--09876543456789257471

!

!

!

!

license udi pid CISCO1841 sn FTX0945W22J

username b privilahege 15 secret 5 $1$Q3#$%^&*()_WdJz9HD.

!

redundancy

!

!

interface FastEthernet0/0

description LAN_Network

no ip address

duplex auto

speed auto

!

!

interface FastEthernet0/0.99

description DMZ_LAN

encapsulation dot1Q 99 native

ip address 10.250.100.129 255.255.255.128

ip helper-address 10.250.100.140

no ip redirects

no ip proxy-arp

ip verify unicast reverse-path

ip flow ingress

ip pim sparse-mode

ip nat inside

ip virtual-reassembly

!

interface FastEthernet0/1

description EIGRP Transit to ASA

ip address 10.250.0.6 255.255.255.252

ip authentication mode eigrp 99 md5

ip authentication key-chain eigrp 99 BIHAUTH

ip nat outside

ip virtual-reassembly

duplex auto

speed auto

!

!

interface Serial0/0/0

no ip address

shutdown

no fair-queue

!

!

!

router eigrp 99

network 10.250.0.4 0.0.0.3

network 10.250.100.128 0.0.0.127

passive-interface default

no passive-interface FastEthernet0/1

eigrp router-id 10.250.0.6

!

ip forward-protocol nd

no ip http server

no ip http secure-server

!

!

ip nat inside source route-map DMZ interface FastEthernet0/1 overload

ip route 0.0.0.0 0.0.0.0 10.250.0.5

!

ip access-list extended internal-ips

permit ip 10.250.100.128 0.0.0.127 10.250.0.4 0.0.0.3

ip access-list extended vtyaccess

permit tcp 10.250.100.0 0.0.0.127 any range 22 telnet

permit tcp 10.250.100.128 0.0.0.127 any range 22 telnet

permit tcp 10.250.150.0 0.0.0.255 any range 22 telnet

permit tcp 10.250.160.0 0.0.0.7 any range 22 telnet

deny   tcp any any

!

!

!

!

route-map DMZ permit 10

description NAT via DMZ

match ip address internal-ips

match interface FastEthernet0/1

!

!

tacacs-server host 10.250.100.142

tacacs-server timeout 1

tacacs-server directed-request

tacacs-server key 7 04795B5301011234567890-09876543234567890

!

control-plane

!

!

!

line con 0

exec-timeout 11 0

logging synchronous

line aux 0

exec-timeout 11 0

line vty 0 4

access-class vtyaccess in

exec-timeout 11 0

logging synchronous

login authentication BiHTac

transport input all

transport output all

!

scheduler allocate 20000 1000

end

BIH_DMZ_RTR#  sh ip route
Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route

Gateway of last resort is 10.250.0.5 to network 0.0.0.0

S*    0.0.0.0/0 [1/0] via 10.250.0.5
      10.0.0.0/8 is variably subnetted, 6 subnets, 3 masks
D        10.250.0.0/30 [90/28416] via 10.250.0.5, 1d23h, FastEthernet0/1
C        10.250.0.4/30 is directly connected, FastEthernet0/1
L        10.250.0.6/32 is directly connected, FastEthernet0/1
D        10.250.100.0/25 [90/30976] via 10.250.0.5, 1d23h, FastEthernet0/1
C        10.250.100.128/25 is directly connected, FastEthernet0/0.99
L        10.250.100.129/32 is directly connected, FastEthernet0/0.99
      192.168.250.0/29 is subnetted, 1 subnets
D        192.168.250.0 [90/30976] via 10.250.0.5, 1d23h, FastEthernet0/1

Mariusz Bochen Thu, 01/02/2014 - 00:28
User Badges:

Hi Kemal,


Happy New Year.


How your proxyarp is setup on ASA ?

Can you issue the following:

sh run all | i sysopt

sh run all | i arp permit-nonconnected



This should be enabled if you use additional LAN on the interface. Perhaps it won't learn MAC address of the TACACS host at the moment.


Regards

Mariusz

Kemal Zuko Thu, 01/02/2014 - 04:55
User Badges:

Hi Mariusz,


Happy New Year to you as well.


Here is the two comands you asked


BIHASA# sh run all | i sysopt

no sysopt connection timewait

sysopt connection tcpmss 1380

sysopt connection tcpmss minimum 0

sysopt connection permit-vpn

sysopt connection reclassify-vpn

no sysopt connection preserve-vpn-flows

no sysopt radius ignore-secret

no sysopt noproxyarp inside

no sysopt noproxyarp DMZ

no sysopt noproxyarp outside

BIHASA#

BIHASA#  sh run all | i arp permit-nonconnected

no arp permit-nonconnected

Mariusz Bochen Thu, 01/02/2014 - 06:24
User Badges:

Thanks for that.

Looks like proxyarp is enabled which is fine but I'm sure if the second feature applies here as I can't find any detailed documentation about that.

Worth trying:


arp permit-nonconnected



Source: http://www.cisco.com/en/US/docs/security/asa/asa84/release/notes/asarn84.pdf

The ASA ARP cache only contains entries from directly-connected subnets by default. You

can now enable the ARP cache to also include non-directly-connected subnets. We do not

recommend enabling this feature unless you know the security risks. This feature could

facilitate denial of service (DoS) attack against the ASA; a user on any interface could send

out many ARP replies and overload the ASA ARP table with false entries.

You may want to use this feature if you use:

• Secondary subnets.

• Proxy ARP on adjacent routes for traffic forwarding.

We introduced the following command: arp permit-nonconnected.

This feature is not available in 8.5(1), 8.6(1), or 8.7(1).


Not sure if this prevents registering MAC addresses in ARP cache only or resolving as well.

Kemal Zuko Thu, 01/02/2014 - 06:55
User Badges:

I tried thhat but getting nowcchere even with enabeling arp permit-nonconnected

Are you sugesting that the tacacs server needs to be directly plugged into the ASA? But at work we have a tacacs server and our production 5580 in diffrent geographical regions and they can still comunicate with each other. I am not sure why this setup is not working, from the looks of it (routing) the ASA knows about that network but cant ping it. I have eco-reply and traceroute permited on all interfaes and I am still not getting there. However the taacs server can ping the DMZ interface of the ASA

Kemal Zuko Thu, 01/02/2014 - 12:44
User Badges:

Ok Issue has been resolved....


After looking some more into the network behind the ASA's DMZ interface I came to notice the following string of comands on the router that is directly connected to the DMZ interface and that is hosting the Tacacs Server behind it's network


ip nat inside source route-map DMZ interface FastEthernet0/1 overload

ip access-list extended internal-ips
permit ip 10.250.100.128 0.0.0.127 10.250.0.4 0.0.0.3

route-map DMZ permit 10
description NAT via DMZ
match ip address internal-ips
match interface FastEthernet0/1


Now I have also noticed tat the ASA has the following NAT statement


nat (DMZ,outside) source dynamic any interface


so there is really no need for the router to pretend that it's douing NAT when the actual NAT is being done on the ASA. I belive that the packet that was comming in from the ASA to the TACACS server was getting blocked by the router, and that is why we never saw the next hop. After removing the NAT, Route Map, and the access-list the ASA started to ping the Tacacs Server and I was able to get authnticated right away.


I would like to thank both Colin Clark and Mariusz Bochen for your time on this it was truly a lerning curve for me.


Thank you again and you both deserve cudos !!!!


Happy New Year

Kemal

Collin Clark Thu, 01/02/2014 - 14:26
User Badges:
  • Purple, 4500 points or more

A true test of our troublshooting skills as well.

Actions

This Discussion