Hi Greg, That does look quite strange indeed. As Peter said, it would be much more helpful if you could send what code you're working on. We we're on 8.2.(1 i believe) and never had any issues similar to what you described. Had to move to 8.3 due to the SSL licensing issue, and now on 8.3.2 (still have not had any issues after I fixed Cisco's wonderful mess it made of my tunnels on the config conversion) but that's another story ....
I hear ya about having alot of config to look through. Management wanted to do the "pay as we grow" and went with a 5540 to start. We're now on our second .... so you could imagine the amount of config we had (almost 100 or so tunnels and to many to remember DMZ's with hundreds of lines of ACL's). Needless to say, I love the cli, but when you have to scale like that, it's just easier on the eyes (and mind lol) to just use the ASDM. As far as your issue, I see that you mention "initially had deny any any" on the "outside -> DMZ" , then towards the bottom of your post, you say that you removed "outside_in". Do you mean "outside -> said DMZ" was remove at the bottom and all started working?? Or did you remove an ACL in that zone set "outside to inside" and it fixed the issue?? Can the host in this DMZ get packets out and if so, what are you seeing when they attempt to come back in the outside interface?? Max On Tue, Jan 25, 2011 at 10:27 AM, Peter Rathlev <[email protected]> wrote: > On Tue, 2011-01-25 at 10:48 -0500, Greg Whynott wrote: > [...] > > capture cap1 access-list capacl1 interface newdmz real-time > [...] > > I see packets egressing the dmz interface into the dmz zone… In my > > mind this is not a firewall issue as the packets are being forwarded > > into the zone, as expected. > > > > the reality is there was a "deny ip any any into newzone" applied to > > the outside interface. I should not of seen these packets when > > running a capture on the dmz interface, correct? this caused me to > > spin my wheels on this for 1/2 a day till I noticed the acl in the > > outside_in section… > > > > soon as I removed the acl element from the outside_in, things > > worked.. > > That does sound strange. Just tried something similar on an ASA 5550 > 8.2(4) with no problems; the capture shows/doesn't show the expected > packets fine. > > You didn't mention platform and version, which is always a good thing if > you want people to test it on something similar. > > Can you recreate this on another pair of interfaces on the same box, > i.e. not towards the "dmz" interface mentioned here? And can you > recreate it on the same interface? > > -- > Peter > > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
