cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1115
Views
0
Helpful
12
Replies

cisco wireless router not allowing full tcp handshake when in router mode

sovemp666111
Level 1
Level 1

I have a recently-purchased cisco rv220w wireless router. My setup is as follows: Internet -> asa 5505 -> 10.0.1.0 subnet -> wireless router (subnet 10.0.3.0, public facing ip is 10.0.1.140).

I can ping between the two subnets fine, but not much else. I did a packet capture with wireshark and noticed something really interesting. If I try to connect from a machine from the 10.0.1.0 subnet to the 10.0.3.0 subnet, say remote desktop for this example, I get a SYN, then a SYN_ACK, and then not ACK back. Only a reset (RST) is getting sent from the machine initiating the connection.

This is super weird. ANy help would please be appreciated. I have the detailed captures if necessary.

12 Replies 12

Kremena Ivanova
Cisco Employee
Cisco Employee

Hi,

 

Is there a static route configured on ASAS5505, saying that network 10.0.3.0 is reachable through 10.0.1.140? Also any firewall restrictions on ASA5505, which could possibly stop the communication?

Where are you making the capture - on RV220 WAN/LAN interface or on the PCs?

 

Regards,

Kremena

Thanks for the reply.

 

1.)  The capture is from the RV220.

2.) I do indeed have a static route configured, e.g.

route inside 10.0.3.0 255.255.255.0 10.0.1.140 1

 

I don't think I have anything blocking the traffic, but here is my access list and nat config:

global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0

 

access-list inbound extended permit icmp any any echo-reply inactive
access-list inbound extended deny ip object-group attackers any
access-list inbound extended permit tcp any any eq ftp inactive
access-list inbound extended permit tcp any any eq www
access-list inbound extended permit tcp any any eq ssh
access-list inbound extended permit tcp any any eq smtp
access-list inbound extended permit tcp any any object-group geoserver inactive
access-list inbound extended permit tcp any any object-group postgres inactive
access-list inbound extended permit icmp any any
access-list vpnsplit extended permit ip 10.0.1.0 255.255.255.0 172.16.22.0 255.255.255.0
access-list nonat extended permit ip 10.0.1.0 255.255.255.0 172.16.22.0 255.255.255.0
access-list nonat extended permit ip 10.0.1.0 255.255.255.0 10.0.3.0 255.255.255.0
access-list nonat extended permit ip 10.0.3.0 255.255.255.0 10.0.1.0 255.255.255.0
access-list inside_mpc extended permit object-group TCPUDP any any eq www
access-list inside_access_in extended deny ip any object-group netflix-ip inactive
access-list inside_access_in extended permit gre any somevpn 255.252.0.0
access-list inside_access_in extended permit tcp any any eq pptp
access-list inside_access_in extended deny ip any 8.0.0.0 255.0.0.0 inactive
access-list inside_access_in extended deny ip any object-group facebook-ip inactive
access-list inside_access_in extended deny ip any object-group spotify-ip inactive
access-list inside_access_in extended deny ip any 216.235.80.0 255.255.240.0 inactive
access-list inside_access_in extended deny ip any object-group limelight-ip
access-list inside_access_in extended deny ip any object-group pandora-ip inactive
access-list inside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
access-list inside_access_in extended permit ip host 10.0.1.46 any inactive
access-list inside_access_in extended permit udp any any eq domain
access-list inside_access_in extended permit udp any any eq ntp
access-list inside_access_in extended permit icmp any any

Also, I noticed something interesting.  Here is a packet-trace from a computer from one subnet trying to remote into the other. It seems that it is hitting the rule [nat (inside) 1 0.0.0.0 0.0.0.0], but I thought my NAT rule was exempting traffic between these two subnets for NAT.  Am I doing something wrong?

 

 packet-tracer input inside tcp 10.0.1.46 33000 10.0.3.151 3389

Phase: 1
Type: FLOW-LOOKUP
Subtype:
Result: ALLOW
Config:
Additional Information:
Found no matching flow, creating a new flow

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.0.3.0        255.255.255.0   inside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit tcp any any object-group DM_INLINE_TCP_1
object-group service DM_INLINE_TCP_1 tcp
 group-object ftpdatatls
 group-object ftptls
 group-object gtalk
 group-object imapssl
 group-object smtp2
 group-object smtpssl
 group-object sqlserver
 port-object eq ftp
 port-object eq ftp-data
 port-object eq www
 port-object eq https
 port-object eq imap4
 port-object eq pop3
 port-object eq smtp
 port-object eq ssh
 port-object eq telnet
 group-object internetradio
 port-object eq whois
 group-object webmail
 group-object rdp
 group-object mtbogcweb
 group-object git
 group-object iCloudSMTP
 group-object whm
 group-object utahsde
 port-object eq 1401
 port-object eq 5442
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type:
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
  match ip inside 10.0.1.0 255.255.255.0 inside 10.0.3.0 255.255.255.0
    NAT exempt
    translate_hits = 23, untranslate_hits = 0
Additional Information:

Phase: 7
Type: NAT-EXEMPT
Subtype: rpf-check
Result: ALLOW
Config:
  match ip inside 10.0.3.0 255.255.255.0 inside 10.0.1.0 255.255.255.0
    NAT exempt
    translate_hits = 0, untranslate_hits = 23
Additional Information:

Phase: 8
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 9
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 10
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 11
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 1, untranslate_hits = 0
Additional Information:

Phase: 12
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 13
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 77684, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow

One more thing.  Here is something interesting from the 220's logs, not sure what it means though:

 

Tue Apr 22 22:39:44 2014(MST) [rv220w][Kernel][KERNEL] NO CONNTRACK FOUND [DROP]  IN=LAN  OUT=WAN SRC=10.0.3.151 DST=10.0.1.46 PROTO=TCP SPT=3389 DPT=55600 
Tue Apr 22 22:39:49 2014(MST) [rv220w][Kernel][KERNEL] NO CONNTRACK FOUND [DROP]  IN=LAN  OUT=WAN SRC=10.0.3.151 DST=10.0.1.46 PROTO=TCP SPT=3389 DPT=55600 

When the mode is changed to Router, the Firewall rules are still active. Meaning that by default WAN to LAN is forbidden. You need to have access rule which allow WAN to LAN trafic

Yeah I know.  I added the WAN to LAN allow all rule in the firewall settings.  Plus, LAN to WAN also has the same problem (both directions), which does not appear to be reset when you change the router mode anyways.

You can test if the problem is caused by RV220 or is some routing issue with ASA5500.

Connect a PC directly to the RV220 WAN port, another to the LAN port, configure all with static IPs and test the RDC.

I have tested RV220 with default configuration in router mode and I cannot replicate this problem.

That is a good idea.  I will try this in a bit.

So, it appears to be the ASA, as when I configure 2 hosts statically as you suggested, everything works fine.  Do you see anything in my config that is making the ASA not play nice?  I posted my access-list and NAT settings at the bottom. 

I'm glade that narrow down the problem to one device, but can't really help with the ASA configuration. It is an Enterprise device and I'm afraid the ASA support engineers do not look in the Small Business Forum very often. 

If ASA is under warranty, maybe it's better to contact the TAC support directly. Hereby the contacts: http://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html.

 

Regards,

Kremena

Okay, well thank you for your help.  I do not believe the ASA is under warranty anymore, would I need to purchase a service contract then?

sovemp666111
Level 1
Level 1
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: