Which ACL is blocking traffic

Question

Hello,I am trying to figure out wich access list is blocking my attempts toconnect to a ASA5500 via Cisco ASDM Launcher. On the console of theASA I am getting the following when I attempt to lauch the ASDM:%ASA-3-710003: TCP access denied by ACL from 172.16.5.133/1983 to inside:172.16.5.201/443%ASA-3-710003: TCP access denied by ACL from 172.16.5.133/1983 toinside:172.16.5.201/443The ASA has dozens of access lists but I dont know which one isstopping me. How can I tell which ACL is affecting this kind oftraffic??Thanks,Pedro

Trendkill · Accepted Answer

Paste your access lists.......or add logging onto them and watch thecounters.

Pedro89 · Answer

This box has almost a hundred ACLs. I will try

Trendkill · Answer

Look for ACLs that match the IP address (172.16 or 172.16.5 or172.16.5.133/201) or ones that have the specific destination portmentioned (443).

Rob · Answer

It should not be too difficult to clear the acl counters and thentry the connection and examine those "deny" acl rules that have anonzero counter.

Daniel-G · Answer

Pedro89 said the following on 07/22/2009 05:14 PM:

On a pix/asa you can use packet tracer either with CLI or ASDM It gives a result even if you don't have deny ip any any at the end of your access-list hope it helps

Andrey Tarasov · Answer

From Error Message    %PIX|ASA-3-710003: {TCP|UDP} access denied by ACL fromsource_address/source_port to interface_name:dest_address/serviceExplanation    This message appears when the security appliance denies an attempt to connect to the interface service. For example, this message appears (with the service SNMP) when the security appliance receives an SNMP request from an unauthorized SNMP management station.Recommended Action    Use the show http, show ssh, or show telnet command to verify that the security appliance is configured to permit the service access from the host or network. If this message appears frequently, it can indicate an attack.==========Regards,Andrey.

Which ACL is blocking traffic

Join the Discussion

Didn't find your answer?