ASA Troubleshooting: Packet-Tracer and Capture
Cisco has released an incredible new feature in ASA software version 7.2(1) that virtually eliminates the guesswork. Packet-tracer allows a firewall administrator to inject a virtual packet into the security appliance and track the flow from ingress to egress. Along the way, the packet is evaluated against flow and route lookups, ACLs, protocol inspection, NAT, and IDS. The power of the utility comes from the ability to simulate real-world traffic by specifying source and destination addresses with protocol and port information.
Packet-tracer is available both from the CLI and in the ASDM. The ASDM version even includes animation (the value of which is questionable, but it is fun to watch), and the ability to navigate quickly to a failed policy.
CLI syntax:
|
1 |
packet-tracer input [src_int] protocol src_addr src_port dest_addr dest_port [detailed] [xml] |
Example:
|
1 2 3 4 5 6 7 |
Testlab# "packet-tracer input inside tcp 10.1.1.1 1024 10.4.1.1 23" Phase: 3 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group inside in interface inside access-list inside extended permit ip any 10.4.1.0 255.255.255.0 |
Packet-tracer does more than just inject a ‘virtual’ packet into the data-plane. One can also add the ‘trace’ option to the capture command, so that actual packets the security appliance receives (which are matched by the capture) are also traced.
|
1 |
Example: ASA# "capture mycap access-list 199 interface outside trace" |
To view the packet-trace from captured packet #3 in the capture, use the command:
|
1 |
ASA# "show capture mycap trace packet-number 3" |