Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Step-by-Step Configuration and Troubleshooting Best Practices for the NGFW, NGIPS and AMP Technologies A Visual Guide to the Cisco Firepower Threat Defense (FTD)
Community Member

Packet Tracer (Implicit Deny) issue

Hello,

I am trying to do a simple packet tracer  on my ASA and this is what I am getting

ASA#       packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.0.6 22 xml

<Phase>
<id>1</id>
<type>ROUTE-LOOKUP</type>
<subtype>input</subtype>
<result>ALLOW</result>
<config>
</config>
<extra>
in   10.250.0.4      255.255.255.252 DMZ
</extra>
</Phase>

<Phase>
<id>2</id>
<type>ACCESS-LIST</type>
<subtype></subtype>
<result>DROP</result>
<config>
Implicit Rule
</config>
<extra>
</extra>
</Phase>

<result>     
<input-interface>DMZ</input-interface>
<input-status>up</input-status>
<input-line-status>up</input-line-status>
<output-interface>DMZ</output-interface>
<output-status>up</output-status>
<output-line-status>up</output-line-status>
<action>drop</action>
<drop-reason>(acl-drop) Flow is denied by configured rule</drop-reason>
</result>
ASA#

The 10.250.0.6 deve is a router directly connected to the DMZ interface 10.250.0.5

However I am getting the reason for droped packet as (Implicit Rule) which I can see is only on the global interface.

I am permiting ip any any on that same interface as well.

How can I make this work?

The reson for this is I need my ASA to authenticate with TACACS server which is behind the 10.250.0.6 router

1 ACCEPTED SOLUTION

Accepted Solutions

Re: Packet Tracer (Implicit Deny) issue

It's just strange that TACACS can't be ping'd, yet traffic through the ASA is good.

What type of device is 10.250.0.6? Do you have access to it?

44 REPLIES
Community Member

Packet Tracer (Implicit Deny) issue

Hi Kemal,

Reading your post 2 things came in to my mind:

1. Why you use /30 mask on your firewall? With this mask you have only 2 useable addresses. One you're going to use for the firewall interface IP, second one for the router.

2. Packet tracer with specified same source and destination network will always fail even if you allow all the traffic and enable same security traffic. Devices communicating within the same subnet will not hit the firewall.

Unless this is just a typo and you should just change the destination IP in the packet tracer? What is your TACACS IP ?

Regards

Mariusz

Community Member

Packet Tracer (Implicit Deny) issue

the reason I have a /30 between my ASA and my router is tat behind my router I have another IP scope for my LAN (10.250.100.128/25)

I am douing dynamic pat on the asa and the router for the workstations to get out

the ip address of the tacacs server is 10.250.100.142 I am getting the same packet tracer resoult with the other IP as well

Community Member

Packet Tracer (Implicit Deny) issue

Would you be able to post the config fot us?

Community Member

Packet Tracer (Implicit Deny) issue

Hello

yes the config is below...

The tow router behing DMZ and INSIDE interfaces on the ASA are able to authenticate against the tacaacs server

ASA Version 9.1(2)

!

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/0

shutdown    

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

!

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

!            

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

!

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http

https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email

callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end

ASA Version 9.1(2)

!

hostname ASA1

enable password Ev0iTru97MKu8IiT encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

names

!

interface GigabitEthernet0/0

nameif inside

security-level 100

ip address 10.250.0.1 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/1

nameif DMZ

security-level 75

ip address 10.250.0.5 255.255.255.252

authentication key eigrp 99 ********* key-id 99

authentication mode eigrp 99 md5

!

interface GigabitEthernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/0

shutdown    

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/1

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/2

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet1/3

nameif outside

security-level 0

ip address dhcp setroute

!

ftp mode passive

object-group service DM_INLINE_TCP_2 tcp

port-object eq ssh

port-object eq telnet

access-list inside_access_in extended permit ip any4 any4

access-list DMZ_access_in extended permit tcp any4 any4 object-group DM_INLINE_TCP_2

access-list DMZ_access_in extended permit ip any4 any4

access-list global_access extended permit ip any4 any4

pager lines 24

logging enable

logging buffered informational

mtu inside 1500

mtu DMZ 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

nat (DMZ,outside) source dynamic any interface

nat (inside,outside) source dynamic any interface

access-group inside_access_in in interface inside

access-group DMZ_access_in in interface DMZ

access-group global_access global

!            

router eigrp 99

no auto-summary

eigrp router-id 10.250.0.5

network 10.250.0.0 255.255.255.252

network 10.250.0.4 255.255.255.252

passive-interface default

no passive-interface inside

no passive-interface DMZ

!

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (DMZ) host 10.250.100.142  >>>>>>>>>>>>>>>> Tacacs Server

key ********

user-identity default-domain LOCAL

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 DMZ   >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

http 10.250.0.6 255.255.255.255 DMZ

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 10.250.100.140 255.255.255.255 DMZ  >>>>>>>>>>>>>>>>>>>>> This is my Domain Controler

ssh 10.250.0.6 255.255.255.255 DMZ

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

username blah password SDFGHJOLKJFCVHJGK. encrypted privilege 15

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email

callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:1e3912f897a34d901d4e60d69e1a3e05

: end

any suggestions?

Thanks

Community Member

Packet Tracer (Implicit Deny) issue

Hi Kemal,

Sorry, but I have few more questions

Can you see the 10.250.100.128/25 network in the routing table (learned by eigrp)?

Are you able to ping the 10.250.100.142 from the ASA's DMZ interface?

Can you please post the result of

packet-tracer input DMZ tcp 10.250.0.5 2234 10.250.100.142 22 ?

Regards

Mariusz

Community Member

Re: Packet Tracer (Implicit Deny) issue

Hello Mariusz,

I can see the 10.250.100.128/25 network in my routing table via EIGRP

here are the resoults you have asked for

ASA# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 12:01:54, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 12:02:04, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 12:01:54, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    75.11.11.0 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 75.11.11.1, outside
ASA#     

ASA# ping 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)


ASA# ping DMZ 10.250.100.142
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.250.100.142, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASA#
ASA#

ASA#  traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

1   *  *  *
2   *  *  *
3   *  *

ASA#

ASA# packet-tracer input dmZ tcp 10.250.0.5 2234 10.250.100.142 22

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
             
Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

ASA# 

When I go to my ASDM and Under MOnitoring/Properties/AAA Servers I see the Tacacs Server configured but under status it says Failed.

here are some of the statistics of that screen

BiHTacTACACS+10.250.100.142Failed

Server port:  49

Number of pending requests  0

Average round trip time   0ms

Number of authentication requests 12

Number of authorization requests 19

Number of accounting requests  0

Number of retransmissions  0

Number of accepts   0

Number of rejects   0

Number of challenges   0

Number of malformed responses  0

Number of bad authenticators  0

Number of timeouts   31

Number of unrecognized responses 0

Also it would be worth mentioning that I can ping 10.250.0.5 (DMZ interface) of the ASA from the Tacacs Server

C:\Users\aaa>ping 10.250.0.5

Pinging 10.250.0.5 with 32 bytes of data:
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254
Reply from 10.250.0.5: bytes=32 time=1ms TTL=254

Ping statistics for 10.250.0.5:
    Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 1ms, Maximum = 1ms, Average = 1ms

C:\Users\aaa>tracert 10.250.0.5

Tracing route to 10.250.0.5 over a maximum of 30 hops

  1     1 ms     1 ms     1 ms  10.250.100.129
  2     1 ms     1 ms     1 ms  10.250.0.5

Trace complete.

Thanks

Packet Tracer (Implicit Deny) issue

We can see that an ACL is dropping the traffic. Can you do another packet-tracer with detail?

packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Community Member

Packet Tracer (Implicit Deny) issue

Sure.. It looks like that it gets dropped by the Implicit Deny rule under Global

ASA# packet-tracer input DMZ udp 10.250.0.5 2234 10.250.100.142 49 detail

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5774bbf0, priority=1, domain=permit, deny=false
        hits=39042567, user_data=0x0, cs_id=0x0, l3_type=0x8
        src mac=0000.0000.0000, mask=0000.0000.0000
        dst mac=0000.0000.0000, mask=0100.0000.0000
        input_ifc=DMZ, output_ifc=any

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 3
Type: ACCESS-LIST
Subtype:     
Result: DROP 
Config:      
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5775fdc0, priority=500, domain=permit, deny=true
        hits=1, user_data=0x6, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=10.250.0.5, mask=255.255.255.255, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Result:
input-interface: DMZ
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Packet Tracer (Implicit Deny) issue

What are you seeing in the logs on your TACACS server? Do you see authentication attempts fromthe ASA?

Community Member

Packet Tracer (Implicit Deny) issue

No I dont see any requests from the 10.250.0.5 (DMZ) to the TACACS Server

here are the only two logs I see on my Tacacs

<94> 2014-01-01 08:11:58 [10.250.100.129:36682] New client connection opened for 10.250.100.15:13334 TID:11

<94> 2014-01-01 08:18:46 [10.250.100.15:13334] New client connection opened for 10.250.100.15:59242 TID:12

The 10.250.100.15 router is behind the 10.250.0.1 (inside interface)

Here is a packet tracer for that interface

ASA# packet-tracer input inside udp 10.250.100.15 2234 10.250.100.142 49 de$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.250.100.128  255.255.255.128 DMZ

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any4 any4
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x5828c890, priority=13, domain=permit, deny=false
        hits=27554, user_data=0x53100dc0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 3
Type: NAT    
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13320, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in  id=0x57717078, priority=0, domain=inspect-ip-options, deny=true
        hits=28028, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any
             
Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in  id=0x56e6b410, priority=0, domain=nat-per-session, deny=true
        hits=13322, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Reverse Flow based lookup yields rule:
in  id=0x57751878, priority=0, domain=inspect-ip-options, deny=true
        hits=18130, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=DMZ, output_ifc=any

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 56599, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:      
input-interface: inside
input-status: up
input-line-status: up
output-interface: DMZ
output-status: up
output-line-status: up
Action: allow

And here is the traceroute from 10.250.100.15 to 10.250.100.142

WLAN_AP>traceroute 10.250.100.142

Type escape sequence to abort.
Tracing the route to 10.250.100.142

  1 10.250.100.1 0 msec 0 msec 0 msec
  2 10.250.0.6 0 msec 0 msec 0 msec
  3 10.250.100.142 8 msec 0 msec 0 msec

I am puzzeld on how the above device can talk to the Tacacs Server but my ASA DMZ interface cant even Ping it.

Packet Tracer (Implicit Deny) issue

Can you try this-

Remove-

aaa-server BiHTac (DMZ) host 10.250.100.142

Add-

aaa-server BiHTac (inside) host 10.250.100.142

key ********

Community Member

Re: Packet Tracer (Implicit Deny) issue

Negative

I now cant even log in using my local database

aaa-server BiHTac protocol tacacs+

accounting-mode simultaneous

aaa-server BiHTac (inside) host 10.250.100.142

key *****

aaa authentication http console BiHTac LOCAL

aaa authentication ssh console BiHTac LOCAL

aaa authentication enable console BiHTac LOCAL

aaa authentication serial console BiHTac LOCAL

aaa authentication telnet console BiHTac LOCAL

aaa authorization command BiHTac LOCAL

http server enable

http 10.250.100.140 255.255.255.255 inside

http 10.250.0.2 255.255.255.255 inside

ssh 10.250.100.140 255.255.255.255 inside

ssh 10.250.0.2 255.255.255.255 inside

ssh timeout 20

ssh version 2

ssh key-exchange group dh-group1-sha1

Re: Packet Tracer (Implicit Deny) issue

When it was set to (DMZ) you were also using local creds to get in correct?

Community Member

Re: Packet Tracer (Implicit Deny) issue

correct,

now I cant get in via ssh or http on inside interface

The only access I have is via console

      

I removed the ssh and http configuration for DMZ

Re: Packet Tracer (Implicit Deny) issue

Go ahead and change it back to (DMZ). Can you enable debug for TACACS and post some of the debug?

Community Member

Re: Packet Tracer (Implicit Deny) issue

you mean to enable tacacs debug on the ASA?

Re: Packet Tracer (Implicit Deny) issue

Yes, sorry.

Community Member

Re: Packet Tracer (Implicit Deny) issue

here is what I see

%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authentication request for user kzuko : Auth-server group BiHTac unreachable

%ASA-6-113015: AAA user authentication Rejected : reason = Invalid password : local database : user = kzuko

%ASA-6-611102: User authentication failed: Uname: kzuko

%ASA-6-611102: User authentication failed: Uname: kzuko

%ASA-6-315011: SSH session from 10.250.0.6 on interface DMZ for user "kzuko" disconnected by SSH server, reason: "Internal error" (0x00)

%ASA-6-302014: Teardown TCP connection 61690 for DMZ:10.250.0.6/54569 to identity:10.250.0.5/22 duration 0:00:07 bytes 1347 TCP FINs

Community Member

Re: Packet Tracer (Implicit Deny) issue

Sorry Wrong log

here is the debug

%ASA-6-302013: Built outbound TCP connection 61851 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/31091 (10.250.0.1/31091)
%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/31091 to inside:10.250.100.142/49
mk_pkt - type: 0x2, session_id: 315
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging cmd-arg=console  Tacacs packet sent
%ASA-6-302014: Teardown TCP connection 61851 for inside:10.250.100.142/49 to identity:10.250.0.1/31091 duration 0:00:00 bytes 0 No valid adjacency
Sending TACACS Authorization message. Session id: 315, seq no:1
%ASA-6-302013: Built outbound TCP connection 61852 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/52801 (10.250.0.1/52801)
TACACS Request timed out
TACACS Session finished. Session id: 315, seq no: 1

mk_pkt - type: 0x2, session_id: 316
mkpkt - authorize user: bihadmin
cmd=no
%ASA-6-302014: Teardown TCP connection 61852 for inside:10.250.100.142/49 to identity:10.250.0.1/52801 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=logging cmd-arg=console  Tacacs packet sent
Sending TACACS Authorization message. Session id: 316, seq no:1
%ASA-6-302013: Built outbound TCP connection 61853 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/28448 (10.250.0.1/28448)
TACACS Request timed out
TACACS Session finished. Session id: 316, seq no: 1

mk_pkt - type: 0x2, session_id: 317
mkpkt - authorize user: bihadmin
cmd=no
cmd-arg=logging %ASA-6-302014: Teardown TCP connection 61853 for inside:10.250.100.142/49 to identity:10.250.0.1/28448 duration 0:00:00 bytes 0 No valid adjacency
cmd-arg=console  Tacacs packet sent
Sending TACACS Authorization message. Session id: 317, seq no:1
%ASA-2-113022: AAA Marking TACACS+ server 10.250.100.142 in aaa-server group BiHTac as FAILED
BIHASA(config)# TACACS Request timed out
TACACS Session finished. Session id: 317, seq no: 1

Re: Packet Tracer (Implicit Deny) issue

Big help, thanks.

%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/31091 to inside:10.250.100.142/49

Can you post another show route?

Community Member

Re: Packet Tracer (Implicit Deny) issue

ASA(config)# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 75.132.0.1 to network 0.0.0.0

D    192.168.250.0 255.255.255.248 [90/28416] via 10.250.0.2, 38:50:54, inside
D    10.250.100.128 255.255.255.128 [90/28416] via 10.250.0.6, 38:50:44, DMZ
D    10.250.100.0 255.255.255.128 [90/28416] via 10.250.0.2, 38:50:54, inside
D    10.250.1.1 255.255.255.255 [90/130816] via 10.250.0.6, 38:50:44, DMZ
C    10.250.0.0 255.255.255.252 is directly connected, inside
C    10.250.0.4 255.255.255.252 is directly connected, DMZ
C    75.132.0.0 255.255.192.0 is directly connected, outside
d*   0.0.0.0 0.0.0.0 [1/0] via 75.132.0.1, outside

Re: Packet Tracer (Implicit Deny) issue

The routing looks good. In your TACACS server, what IP is configured as the host? The ASA's DMZ address?

Re: Packet Tracer (Implicit Deny) issue

Can we try and put a host specific route in for the TACACS server?

route DMZ 10.250.100.142 255.255.255.255 10.250.0.6

Then check the debug log again.

Community Member

Re: Packet Tracer (Implicit Deny) issue

Ok did that but still nothing

I am also not seeng much in the debug

sh debug  tacacs

%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authorization request for user bihadmin : Auth-server group BiHTac unreachable

debug tacacs session

ASA(config)# %ASA-7-111009: User 'bihadmin' executed cmd: show debug tacacs

I got debug tacacs and debug tacacs session running on logging console debugging

Community Member

Re: Packet Tracer (Implicit Deny) issue

ok I have noticed that these error loggs come in very late. I got this error log below 5 min later

%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63066 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/6622 (10.250.0.1/6622)
%ASA-6-110003: Routing failed to locate next hop for TCP from identity:10.250.0.1/6622 to inside:10.250.100.142/49
mk_pkt - type: 0x2, session_id: 332
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug cmd-arg=tacacs  Tacacs packet sent
%ASA-6-302014: Teardown TCP connection 63066 for inside:10.250.100.142/49 to identity:10.250.0.1/6622 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
Sending TACACS Authorization message. Session id: 332, seq no:1
%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63067 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/46116 (10.250.0.1/46116)
TACACS Request timed out
TACACS Session finished. Session id: 332, seq no: 1

mk_pkt - type: 0x2, session_id: 333
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug %ASA-6-302014: Teardown TCP connection 63067 for inside:10.250.100.142/49 to identity:10.250.0.1/46116 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
cmd-arg=tacacs  Tacacs packet sent
Sending TACACS Authorization message. Session id: 333, seq no:1
%ASA-7-609001: Built local-host inside:10.250.100.142
%ASA-6-302013: Built outbound TCP connection 63068 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/47263 (10.250.0.1/47263)
TACACS Request timed out
TACACS Session finished. Session id: 333, seq no: 1

mk_pkt - type: 0x2, session_id: 334
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=debug %ASA-6-302014: Teardown TCP connection 63068 for inside:10.250.100.142/49 to identity:10.250.0.1/47263 duration 0:00:00 bytes 0 No valid adjacency
%ASA-7-609002: Teardown local-host inside:10.250.100.142 duration 0:00:00
cmd-arg=tacacs  Tacacs packet sent
Sending TACACS Authorization message. Session id: 334, seq no:1
%ASA-2-113022: AAA Marking TACACS+ server 10.250.100.142 in aaa-server group BiHTac as FAILED
debug tacacs session
TACACS Request timed out
%ASA-4-409023: Attempting AAA Fallback method LOCAL for Authorization request for user bihadmin : Auth-server group BiHTac unreachable
%ASA-7-111009: User 'bihadmin' executed cmd: show debug tacacs
BIHASA(config)# TACACS Session finished. Session id: 334, seq no: 1

%ASA-6-305012: Teardown dynamic UDP translation from inside:10.250.100.4/52561 to outside:75.1.1.1/52561 duration 0:00:31

Community Member

Re: Packet Tracer (Implicit Deny) issue

I have also noticred this

%ASA-6-302013: Built outbound TCP connection 63066 for inside:10.250.100.142/49 (10.250.100.142/49) to identity:10.250.0.1/6622 (10.250.0.1/6622)

It mentions "inside" the 10.250.100.142 is behind the DMZ

ok... for some reason it didint take my last commands when I was putting it back on to the DMZ

Lets try the debug again

Community Member

Re: Packet Tracer (Implicit Deny) issue

Nothing no debug loggs this time when I try to connect

Community Member

Re: Packet Tracer (Implicit Deny) issue

sometimes I see this

mk_pkt - type: 0x2, session_id: 370
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 370, seq no:1
TACACS Request Timed out. Session id: 370, seq no:1
mk_pkt - type: 0x2, session_id: 371
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 371, seq no:1
TACACS Session finished. Session id: 370, seq no: 1

TACACS Request Timed out. Session id: 371, seq no:1
mk_pkt - type: 0x2, session_id: 372
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 372, seq no:1
TACACS Session finished. Session id: 371, seq no: 1

TACACS Request Timed out. Session id: 372, seq no:1
TACACS Session finished. Session id: 372, seq no: 1

mk_pkt - type: 0x2, session_id: 373
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 373, seq no:1
TACACS Request Timed out. Session id: 373, seq no:1
mk_pkt - type: 0x2, session_id: 374
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 374, seq no:1
TACACS Session finished. Session id: 373, seq no: 1

TACACS Request Timed out. Session id: 374, seq no:1
mk_pkt - type: 0x2, session_id: 375
mkpkt - authorize user: bihadmin
cmd=show
cmd-arg=access-list cmd-arg=DMZ_access_in cmd-arg=brief  Tacacs packet sent
Sending TACACS Authorization message. Session id: 375, seq no:1
TACACS Session finished. Session id: 374, seq no: 1

TACACS Request Timed out. Session id: 375, seq no:1
TACACS Session finished. Session id: 375, seq no: 1

Re: Packet Tracer (Implicit Deny) issue

I saw that too and that's what made me think it could be a routing issue. Can you do another packet-tracer?

packet-tracer input DMZ udp 10.250.0.5 49 10.250.100.142 49 detail

2378
Views
45
Helpful
44
Replies
CreatePlease to create content