Troubleshooting Access Problems Using Packet-Tracer


Thu, 01/26/2017 - 09:17
Jul 3rd, 2009

Troubleshooting access problems through a firewall is often very difficult, especially when speed to resolution is critical. Errors in long complex ACLs can be easily overlooked, and access failures caused by NAT, IDS, and routing make the problem even more difficult.

Cisco has released an incredible new feature in ASA software version 7.2(1) that virtually eliminates the guesswork. Packet-tracer allows a firewall administrator to inject a virtual packet into the security appliance and track the flow from ingress to egress. Along the way, the packet is evaluated against flow and route lookups, ACLs, protocol inspection, NAT, and IDS. The power of the utility comes from the ability to simulate real-world traffic by specifying source and destination addresses with protocol and port information.

Packet-tracer is available both from the CLI and in the ASDM. The ASDM version even includes animation (the value of which is questionable, but it is fun to watch), and the ability to navigate quickly to a failed policy.

Here is the CLI syntax:

packet-tracer input [src_int] protocol src_addr src_port dest_addr  dest_port [detailed] [xml]

A few examples of truncated output show some of the most useful features. Not only does the tool show the result of an ACL evaluation, but also the specific ACE that either permits or denies the packet, including a hit on the implicit deny.

asaTestlab# "packet-tracer input inside tcp 1024 23"

Phase: 3
Subtype: log
Result: ALLOW
Config: access-group inside in interface inside access-list inside extended permit ip any

Additional Information:

asaTestlab# "packet-tracer input inside tcp 1024  5282"

Phase: 3
Subtype: log
Result: DROP
Config:  access-group inside in interface inside access-list inside extended deny tcp any host eq 5282

Additional Information:

Evaluations of other elements of the config are similarly specific. Here is an example with nat-control enabled but without proper address translation defined:

asaTestlab# "packet-tracer input DMZ tcp 1024 http"

Phase: 7
Type: NAT
Result: DROP
nat (DMZ) 0 access-list NoNAT
    match ip DMZ any outside any
       no translation group, implicit deny
       policy_hits = 1

Additional Information:

- Kevin Miller, Herman Miller, Inc., Zeeland, Michigan, USA

Packet-tracer does more than just inject a 'virtual'  packet into the data-plane. One can also add the 'trace' option to  the capture command, so that actual packets the security appliance  receives (which are matched by the capture) are also traced.

Example:  ASA# "capture mycap access-list 199 interface outside trace"

To view the packet-trace from captured packet #3 in the capture, use the command:  ASA# "show capture mycap trace packet-number 3"

To receive the latest information on Cisco online tools, certifications, support documentation, insights from Cisco experts and peers, and upcoming events, check out the Cisco Technical Services Newsletter today.

Matias Ortiz Thu, 10/13/2016 - 10:26

Hi, thanks for the post. These are helpful tools.

The link Cisco Technical Services Newsletter doesn't work for me, do you know if changed?


Travis Williams Thu, 10/13/2016 - 10:34

Hi Matias,

You're welcome!

Unfortunately, the Cisco Technical Services Newsletter was retired in 2014. My apologies for the inconvenience.

Thank you,


DarylBrooks Thu, 01/26/2017 - 09:17

I know this is a post on an old thread, however when I run the packet tracer I receive the below:

Phase: 3
Result: DROP
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xaca4b278, priority=11, domain=permit, deny=true
hits=1356658853, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip=, mask=, port=0
dst ip=, mask=, port=0, dscp=0x0

How can I decipher the hex ID for the access-list that is causing the packets to be dropped, as there is not a line with that Hex value from what I can see in the config.




This Document

Related Content