Test ACL to see which ACE is blocking traffic

On the ASA and FWSM, is there a way to check which ACE would be blocking a particular traffic? I'm looking for a command where I just tell it which ACL is use and feed it the source-ip/port and dest-ip/port.
Thank you in advanced.
Vince

Hi,
Well the ASA does have a tool that can easily tell you which ACL rule some traffic hits. Though I guess there is a very small change that you would have so old software that its not supported but I doubt it. This command isnt supported on FWSM however.
On ASA you can use the "packet-tracer" command.
Basically if you want to test traffic incoming from "inside" interface then you could do (IPs and ports are made up)
packet-tracer input inside tcp 10.10.10.10 12345 8.8.8.8 80
Traffic incoming from "outside" could be simulated with
packet-tracer input outside tcp 1.1.1.1 12345
I am not completely sure but on the FWSM (and also ASA side) side you might be able to look at the log message of the blocked connection and look at the very end of the log message that has a sequence of numbers. This might match some ACE in that interfaces ACL when you look at the ACL through with command "show access-list"
For example I made a "deny" rule on my ASA like this
access-list WAN-IN line 1 extended deny ip host 3.3.3.3 any
I then generate traffic from source address 3.3.3.3 to one of my internal IP addresses and ASA generates this log message
Deny tcp src WAN:3.3.3.3/12345 dst LAN:10.0.10.1/80 by access-group "WAN-IN" [0x6131ef0b, 0x0]
I then check my ACLs with "show access-list | inc 6131ef0b" which essentially contains the number sequence I told about earlier. The output is the following and we have found the ACL rule that blocked the connection attempt
ASA# show access-list | inc 6131ef0b
access-list WAN-IN line 1 extended deny ip host 3.3.3.3 any (hitcnt=3) 0x6131ef0b
Hope this helps
Please do remember to mark a reply as the correct answer if it answered your question.
Feel free to ask more if needed
- Jouni

Similar Messages

ACE - bridged mode - blocking Traffic

Hi
Just a short question. Is an ACE blocking traffic from a Source if the mac-address of that source is not in the ARP/MAC table? No security feature is enabled. The sniffer shows, that the packet is not going through. Other traffic works fine. So no problem with incoming ACL or something else. Any reason for that.
Cheers
patrick

Patrick,
indeed, if the src mac is not in the arp table, we can't setup a flow entry for that traffic and it is dropped.
We should first learn the mac-address from arp traffic.
Also check the following command to see if that helps:
switch/Admin(config-if)# arp inspection validate src-mac ?
flood Enable the flood option
no-flood Enable the no flood option
Carriage return.
Gilles.

Hi I have an old fsnet email address which has been blocked. How do I unblock it

I have an old freeserve email address which has been blocked. This has happened before and I just contacted Orange (took over Freeserve) and then it was released to e again.
How do I do that now that EE have taken over Orange.
My old email s [email protected]

It makes no diif that EE has taken oven Orange. EE still handles all the email domains back to Freeserve ones.
Are you logging in here: http://email.orange.co.uk/ ?
You need to contact EE to unblock it. There is a so-called "email" form that you can use for BB: https://explore.ee.co.uk/broadband/email-us . Also see below in my sig.

Which field indicates blocked vendor in vendor master in R3?

Hi,
Which field indicates a blocked vendor in vendor master in R3?
Thanks in advance
Regards,
Ramesh-

Hi,
Enter T.code : XK03 enter the v.code
go to environment -> account changes-> all changes
you can see all the changes here
It is blocked you can see the date at which it is blocked
try
G.Ganesh Kumar

Which is the correct way to filter/block traffic between vlans?

Hi all. My question is: Which is the correct way to filter/block traffic between vlans?
i have a more than 15 vlans. I want to block traffic between them except 2 vlans.
source vlan 3 deny destination vlan 4
#access-list 100 deny ip 192.168.3.0 0.0.0.255 192.168.4.0 0.0.0.255
and the oposite:
#access-list 101 deny ip 192.168.4.0 0.0.0.255 192.168.3.0 0.0.0.255
I have to do this for all VLANs, ono by one. Is that right?
Thanks.

There are a couple of ways to achieve that. I assume that you have a Layer3-Switch. There I would configure one ACL per vlan-interface and allow/deny the traffic as you want. Sadly, the Switches don't support object-groups yet, so you have to use the IP-networks here. Only allow/deny traffic based on networks or hosts. Don't even try to be very granular with permit/denys based on ports. Because the switch-ACLs are not statefull you'll run into problems for the return-traffic if you woulf do that. And the return-traffic of course has to be allowed also.
Another way: with the help of 802.1x you can deploy port-based ACLs for every user. That takes some time for planning, but is one of the most powerful solutions.
For more control you could remove the L3-interface from your L3-switch and move that to your router or firewall. These devices support stateful filtering and you can control your traffic much tighter tehn with ACLs on the switch.
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

In settings, I cannot see personal hotspot, is blocked by my carrier? I have iPhone 4 with ver 4.3.5

In settings, I cannot see personal hotspot, is blocked by my carrier? I have iPhone 4 with ver 4.3.5
How can activate this function?

Your carrier has to support it and you generally have to pay for a tethering plan. Here is a list of supported carriers, noting which ones support Personal Hotspot: http://support.apple.com/kb/ht1937

Identifing which session is blocking which session

Dear All,
We are having 500 user we don't have Database administrator.
All of us are Form6i/Report6i developers.
We do basic DBA activities liking creation of user, taking backup etc.
Recently we have started facing follwoing problem:
1) Our HR department uses 5-10 different types of report.
Other departments uses 1-5 types of reports.
HR & Other department even though refering to different reports are using some common tables which are used in HR as wel as Other department's report.
Report of HR gets hanged.
What we observe in "Enterprise Manager Console" in session that there are non HR user which are also running report.
The information we see is "Memory Usage","I/O reads","CPU time","Session","User" and so on. We just see who is using maximum memory or CPU time or I/O reads and on basis of that we kill the user (which may be inappropriate)
What we are enable to understand is at that point of time which user SQL is blocking which user.
e.g: user "PKP0001" session is inactive and he calls us and tells my report is hanged. We want to identify which user if we kill will allow "PKP0001" user's report to get executed.
2) User executes there report and get the result on the screen. User gets what he wants but when we see in Enterprise Manager Console" in session even though his task is complete it shows status as inactive with his high "I/O reads","Memory", "CPU" time. so we have to identify and call that user confirm whether he is running any form or report if not then kill his session or ask him to close the application.
In this case how would we identify without asking the user whether he doing something or not.
Any mehtod we need to implement in our form6i and report 6i which will take care of that.
Kindly suggest as soon as possible.
Thanking You in anticipation.
Devendra .

Devendra,
It is fairly easy to determine which session is blocking another session. Take a look at the SQL statements in this thread (the SQL statements are not well explained, but the output might be understandable):
enq TX locked row
The first, which queries V$SESSION_WAIT and V$SESSION, shows the wait event (on 10g and above, provides a better clue as to the reason session is waiting), the number of seconds waiting, SQL_ADDR and SQL_HASH_VALUE (may be used to find the SQL statement the session submitted), and details potentially describing the object being waited on, the specific absolute data file number, the block number, and the row within the block (DBMS_ROWID.ROWID_CREATE may be used to generate a ROWID to use to query the table in order to determine the actual contents of the row being waited on). The definition of P1, P2, and P3 vary by the type of wait event. In this case, lock mode and lock type for the waiting session may be derived from the P1 value.
The second, which queries V$LOCK and V$SESSION, shows the two sessions involved in the lock. SID 150, in all cases is blocking SID 143 (as indicated by the BLOCK column). The other columns returned may be used to determine the SQL statements executed by each session (the SQL statement should have retrieved SQL_ADDR also on 10g and above), and the type of locks involved by both sessions.
Other examples:
Thorough example of using the information from V$LOCK:
http://jonathanlewis.wordpress.com/2008/02/06/trouble-shooting-2/
"How do you find out who is locking a specific row in a table?"
http://www.jlcomp.demon.co.uk/faq/row_locker.html
"Enqueue Waits and Locks" by Kyle Hailey:
http://www.nocoug.org/download/2006-08/unit5_enqueues.ppt
Charles Hooper
IT Manager/Oracle DBA
K&M Machine-Fabricating, Inc.

Can you see which timeline clips are being used in Media Browser?

I'm a relatively new user and may not be familiar enough with cs5.5 but
is there a way to see what clips are being used on the editing timeline in the media browser.
I open premiere pro - Project is loaded. I edit the scene until it is finished.
When I look over at the media browser, all my raw clips (some of which I'm
using on the editing timeline) look the same - I can't tell which ones I using on the timeline.
The reason I ask - when I fiinish editing a scene it would be nice to glance over at the
media brower folder where my raw clips are located - easily see which ones I'm using because they
are highlighted or checked and then delete the ones I no longer need.
Is there a way to do this now?
Thanks
Jeff

I dont think so but a better way is to look in the top of the Project Window and there is a drop down that will show you all the useage instances of the clip. You can click on them to go to them in the timeline.

HT1391 I have accidantally created anoth iTunes library file and ripped a lot of music in it. Than I discovered that this music was not arrived in one library file. Know I would like to merge all my music in one library file but don't see which library is

Hi,
Regarding my Itunes library:
I'll try to explain my situation (sorry for my english).
I have a networkdrive where all my music is stored on. Itunes is installed on my macbook and I entered the network drive as my media file location.
I use my macbook to rip music and buy itunes music assuming it will all be placed in the media folder that I once entered.
Recently I found out that itunes had changed the location of my media folder to the local drive.
Since a time now (I can't exactly say when) I'm ripping many of my music collection to itunes.
Today i discovered the change of my media file location by itunes after I ripped some collections. When clicking the info button on some of the ripped files I see that they are not stored on my networkdrive, very normal, since the location of the media file is changed to local computer.
When I look in the finder I can find a local libray file (xml file) from 13 april and also one on my network drive but the date is from March. So this one is even older.
I suppose that the libray file is updated each time I add a song in itunes. So there must be anonther library file somewhere?
Is there a way to see which libarary file is used in itunes? I know you can start Itunes with the option key to select another library file but is it also possible to view in itunes which library file is used so I can consult the path of the library file in use?
What should i do to put all the local music to to my network drive and update the correct library to the new location of these files?
Why is there no alert when Itunes changes the location of the media files path?
Thanks

hi i had the same problem today when i updated my itunes to latest version. however, i have just found my songs in the 'itunes media' folder. this was accessed through 'my music' then keep clicking through until you find itunes media and all my library songs were in there and i then just added these files to my library and all were restored however, i have lost all my playlists but at least my 700 songs are back. very dissapointed with apple that they have let this happen with their latest update, the previous version was miles better than this one . hope you find them. stevo

In SQL Trace how to see which statement getting more time .

Hi Expart,
In SQL Trace (T-code ST05) . I am running the standard transaction . how to see which statement
running more time and less time . suppose one statement running more time so how resolve the
performance .
Plz. reply me
Regards
Razz

> The ones in 'RED' color are the statement which are taking a lot of time and you need to
> optimise the same.
No, that is incorrect, the red ones show only the ones which need several hundret milliseconds in one execution. This can even be correct for hard tasks. And there are lots of problem, which you will not see
I have said everything here:
SQL trace:
/people/siegfried.boes/blog/2007/09/05/the-sql-trace-st05-150-quick-and-easy
Go to 'Tracelist' -> Summarize by SQL statements', this is the view which you want to see!
I summarizes all executions of the same statement.
There are even the checks explained, the slow ones are the one which need a lot of time per record!
See MinTime/Rec > 10.000 microseconds.
Check all number of records, executions, buffer, identicals.
The SE30 Tipps and Tricks will not help much.
Siegfried

I am using Outlook 2010 and have a iphone 4s. In Outlook I have issues with my contacts not being the same as what I have corrected them to be. Is there a way to check and see which file Outlook is sharing with I-cloud?

I am using Outlook 2010 and I also use a Iphone 4s. I use Outlook to correct all my contacts and them it sync with my phone BUT I get different variations of the contacts. Almost as if there is another file it is going to. Can I check to see which file it is reading from??

This may be helpful.
http://itconflict.com/2012/01/08/troubleshooting-icloud-sync-with-outlook/

See which clips are already used in the sequence

hi there,
I am a complete newby for mac and fce
I started a project for my dive video in the Filippines.
I have like a 1000 clips in the browser.
Is there a way in fce to see which clips are already use in the sequence and which are not?
In pinacle studio they were marked with a red v

This is a way to solve your problem.
http://discussions.apple.com/thread.jspa?threadID=2283002&tstart=0

Can you see which apps are open and/or running like you can on an android phone by going to settings applications running services?

can you see which apps are open and/or running (like you can on an android phone by going to settings>applications>running services)?

Hi wjosten,
thank you for the help. I should have said I had a iphone 3. A friend has the same phone and she showed me how she can see what web pages are open when she double taps the home button. Mine is set to bring up favourites when I double tap (chosen from settings>general>home button).. BUT my choices are only HOME; SEARCH; PHONE FAVORITES; CAMERA or IPOD. I changed my choice to HOME but that just defeats the purpose as when I am at the home page and double tap nothing happens. Am I making sense?

How can I see which roles or users have access to a table?

How can I see which roles or users have access to a table?
For a given table, how can I see the grants, who and what?
Many thanks

dba_tab_privs.
Grantee can be a role or an user, as roles are fake users.
Sybrand Bakker
Senior Oracle DBA

How can I see which and how many iCloud accounts have been created on my Mac?

I have reached the limit of iCloud accounts that can be created on my Mac (bit of a shock, I was blissfully unaware that there is a limit). In the past I had an iCloud account for each user but have since consolidated the users, now I am wondering if there is some way of seeing which accounts are attached to my Mac ID.
Additionally if I delete some of those iCloud accounts, does the available limit reset? (From posts it seems not, but no real clarity on the issue).
Thanx

AFAIK this information is not available, but in any case there is nothing you can do once the limit has been reached. Of course you can check which accounts are signed in, but not accounts which may have been created but signed out from. Deleting accounts won't reset the limit, it's tied to the hardware (not the user account).
If you want another account the only way is to create it on another device: then you can sign into it on your Mac.

Test ACL to see which ACE is blocking traffic

Similar Messages

Maybe you are looking for