OpenForum RSS: asa5520 ACL

asa5520 ACL (Om)

Mon, 06 May 2013 09:44:46 GMT

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 172.31.0.0 255.255.0.0 xxx-dc

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0xd839b0a8, priority=11, domain=permit, deny=true
hits=0, user_data=0x5, cs_id=0x0, flags=0x0, protocol=0
src ip=0.0.0.0, mask=0.0.0.0, port=0
dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: xxx-dc
input-status: up
input-line-status: up
output-interface: xxx-dc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

asa5520 ACL (Om)

Mon, 06 May 2013 09:44:25 GMT

1: 13:19:45.979227 802.1Q vlan#216 P0 172.31.1.18.60493 > 172.27.0.10.445: P 3467662171:3467662415(244) ack 256553634 win 571
2: 13:19:45.982203 802.1Q vlan#216 P0 172.27.0.10.445 > 172.31.1.18.60493: P 256553634:256553878(244) ack 3467662415 win 255
3: 13:19:45.983500 802.1Q vlan#216 P0 172.31.1.18.60493 > 172.27.0.10.445: P 3467662415:3467662621(206) ack 256553878 win 570
4: 13:19:45.987162 802.1Q vlan#216 P0 172.27.0.10.445 > 172.31.1.18.60493: . 256553878:256555258(1380) ack 3467662621 win 254
5: 13:19:45.987253 802.1Q vlan#216 P0 172.27.0.10.445 > 172.31.1.18.60493: P 256555258:256556058(800) ack 3467662621 win 254
6: 13:19:45.987986 802.1Q vlan#216 P0 172.31.1.18.60493 > 172.27.0.10.445: . ack 256556058 win 562
7: 13:19:45.988947 802.1Q vlan#216 P0 172.31.1.18.60493 > 172.27.0.10.445: P 3467662621:3467662713(92) ack 256556058 win 562
8: 13:19:45.991464 802.1Q vlan#216 P0 172.27.0.10.445 > 172.31.1.18.60493: P 256556058:256556186(128) ack 3467662713 win 254
9: 13:19:46.188115 802.1Q vlan#216 P0 1

asa5520 ACL (Om)

Mon, 06 May 2013 09:14:28 GMT

>[�� ]
>> nameif xxx-dc
>> security-level 100
>> ip address 172.17.4.1 255.255.255.248
>> object-group network xxx-distr
>> network-object 172.31.0.0 255.255.0.0
>> route xxx-dc 172.31.0.0 255.255.0.0 172.17.4.2 2
>> access-list acl-xxx-distr extended deny ip object-group xxx-distr any
>> access-group acl-xxx-distr in interface xxx-dc
>> �� , �� . ��?
> �� ?

�� .

asa5520 ACL (Merridius)

Tue, 30 Apr 2013 14:58:34 GMT

>[�� ]
> vlan 216
> nameif xxx-dc
> security-level 100
> ip address 172.17.4.1 255.255.255.248
> object-group network xxx-distr
> network-object 172.31.0.0 255.255.0.0
> route xxx-dc 172.31.0.0 255.255.0.0 172.17.4.2 2
> access-list acl-xxx-distr extended deny ip object-group xxx-distr any
> access-group acl-xxx-distr in interface xxx-dc
> �� , �� . ��?

�� ?