Hi Vijay,
Thanks, that was very helpful.
With the help of the troubleshooting tools you suggested, we finally
determined the culprit.
In addition to the configs I shared, we also had:
----------------------
class-map connection_limits
match any
!
policy-map outside_policy
class connection_limits
set connection per-client-max 10000
!
service-policy outside_policy interface outside
----------------------
By messing around with the policy-maps, we discovered that the
connection_limits class of the policy-map on the outside interface was
trumping the tcp_state_bypass class of the global policy-map.
We resolved the issue by modifying the policy-map on the outside
interface as follows:
----------------------
policy-map outside_policy
class tcp_state_bypass
set connection per-client-max 10000
set connection advanced-options tcp-state-bypass
class connection_limits
set connection per-client-max 10000
----------------------
We have two ASA firewalls, and the problem is still happening on the
other one. I suspect that the default inspection class of the global
policy is trumping the tcp_state_bypass class, but we have to run some
tests during off-hours to be sure.
I'll post the results here.
Thanks so much.
Adam
On 1/27/2011 2:05 PM, Ramcharan, Vijay A wrote:
I put a basic config together in a lab and do not see any issues.
Ensure that you have permitted the traffic on your outside interface
ACL. Without a permit for the traffic I get the same "Deny TCP (no
connection)" messages that you listed.
Use the packet tracer feature on the ASA to verify that the traffic is
being permitted by your firewall security policy.
----------------------
asa5505-1# sho ver
Cisco Adaptive Security Appliance Software Version 8.2(4)
----------------------
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list outside extended permit icmp any any
access-list outside extended permit tcp host 1.1.1.1 host 2.2.2.2
----------------------
access-list state-byp extended permit tcp host 1.1.1.1 host 2.2.2.2
access-list state-byp extended permit tcp host 2.2.2.2 host 1.1.1.1
----------------------
class-map class-state-byp
match access-list state-byp
----------------------
policy-map global_policy
class class-state-byp
set connection advanced-options tcp-state-bypass
----------------------
asa5505-1# show access-li
access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)
alert-interval 300
access-list outside; 2 elements; name hash: 0x1a47dec4
access-list outside line 1 extended permit icmp any any (hitcnt=0)
0x390a154c
access-list outside line 2 extended permit tcp host 1.1.1.1 host 2.2.2.2
(hitcnt=2) 0x487c7639
access-list state-byp; 2 elements; name hash: 0x85668841
access-list state-byp line 1 extended permit tcp host 1.1.1.1 host
2.2.2.2 (hitcnt=1) 0x3b6e8bc3
access-list state-byp line 2 extended permit tcp host 2.2.2.2 host
1.1.1.1 (hitcnt=0) 0xe49de108
----------------------
Jan 27 2011 10:34:38: %ASA-6-302303: Built TCP state-bypass connection 3
from outside:1.1.1.1/23 (1.1.1.1/23) to inside:2.2.2.2/56353 (2.2.2.2
/56353)
----------------------
Without an interface ACL permit:
Jan 27 2011 10:38:59: %ASA-6-106015: Deny TCP (no connection) from
1.1.1.1/23 to 2.2.2.2/19821 flags SYN ACK on interface outside
Jan 27 2011 10:39:01: %ASA-6-106015: Deny TCP (no connection) from
1.1.1.1/23 to 2.2.2.2/19821 flags SYN ACK on interface outside
Jan 27 2011 10:39:01: %ASA-6-106015: Deny TCP (no connection) from
1.1.1.1/23 to 2.2.2.2/19821 flags ACK on interface outside
asa5505-1# packet input outside tcp 1.1.1.1 telnet 2.2.2.2 4500
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
----------------------
With an interface ACL permit:
asa5505-1# packet input outside tcp 1.1.1.1 telnet 2.2.2.2 4500
Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: allow
----------------------
Vijay Ramcharan
-----Original Message-----
From: [email protected] [mailto:cisco-nsp-
[email protected]] On Behalf Of Adam Greene
Sent: Thursday, January 27, 2011 11:41 AM
To: [email protected]
Subject: [c-nsp] ASA tcp-state-bypass error/bug?
Hi all,
I've opened a new thread for this issue (was: "asymmetric multihoming
&
nat").
Having an issue on an ASA device (8.2(4)) with tcp-state-bypass
enabled.
Despite these configs:
access-list tcp_state_bypass_acl extended permit ip any host 12.0.1.28
access-list tcp_state_bypass_acl extended permit ip host 12.0.1.28 any
!
class-map tcp_state_bypass
match access-list tcp_state_bypass_acl
!
policy-map global_policy
class tcp_state_bypass
set connection advanced-options tcp-state-bypass
!
service-policy global_policy global
(note that these configs are for test traffic, hence referencing only
a
single host)
I am still seeing the logs
2011-01-26 16:53:59 Local4.Debug 10.10.30.3 %ASA-7-609001:
Built local-host outside:12.0.1.28
2011-01-26 16:53:59 Local4.Info 10.10.30.3 %ASA-6-106015:
Deny
TCP (no connection) from 12.0.1.28/23 to 204.8.80.5/54015 flags SYN
ACK
on interface outside
2011-01-26 16:53:59 Local4.Debug 10.10.30.3 %ASA-7-609002:
Teardown local-host outside:12.0.1.28 duration 0:00:00
Supposedly configuring tcp-state-bypass on the ASA should allow this
traffic, but it doesn't seem to be working.
I'm not seeing hits on the ACL either:
access-list tcp_state_bypass_acl line 1 extended permit ip any host
12.0.1.28 (hitcnt=0)
access-list tcp_state_bypass_acl line 2 extended permit ip host
12.0.1.28 any (hitcnt=0)
Could this be a bug? Am I missing something obvious?
I even added
tcp-map synackallow
synack-data allow
invalid-ack allow
!
class syn_ack_allow
set connection advanced-options synackallow
!
policy-map global_policy
class syn_ack_allow
set connection advanced-options synackallow
in case that would help. Nope, it did not.
Thanks,
Adam
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
