Routes are all correct etc and when running a packet tracer the networks are hitting the same routes / rules and hitting the VPN but only 10.94.0.0/16 and 10.98.0.0/24 is passing traffic. The others are getting "Drop-reason: (acl-drop) Flow is denied by configured rule" but I have no idea why.
when checking the ASP table I can see the drops but - its saying ACL Drop but there is no difference between the 10.97.0.0/24 and 10.98.0.0/24 networks rule wise
259: 09:53:07.166327 10.97.0.10 > 10.94.0.4: icmp: echo request Drop-reason: (acl-drop) Flow is denied by configured rule
From the IPSEC tunnel I can see the decaps constantly increasing but the ASA is dropping this traffic for some reason
I am remotely accessing the firewall and its a production firewall so a lot of stuff passing through so would rather not turn on termial logging.
I would have thought ASDM would would show me the drops? But nothing showing in there for the traffic.
I have captures set up for the traffic also but nothing in them either but I am seeing the drops in the ASP table. If memory servers me correct, if the ASP table shows the drops the traffic wont appear in the ASDM logs or captures - but not 100% sure on that
capture azure1 type raw-data interface REMOTE [Capturing - 0 bytes] match icmp host 10.98.0.20 host 10.95.0.5 capture azure2 type raw-data interface REMOTE [Capturing - 0 bytes] match icmp host 10.97.0.10 host 10.94.0.4 capture azure3 type raw-data interface REMOTE [Capturing - 0 bytes] match icmp host 10.97.0.10 host 10.95.0.5
My global policy is not inspecting icmp traffic so not sure what is happening here.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...