What goes where ???

Question

I've used cisco for some time now, and are realy happe with it, but there is one thing i need to get a hang of..
Traffic from one vlan going out to internet, and traffic comming back...
All i see is traffic comming from 1 ip out on internett going to my external ip on any given port.
Is there a way i can wee what inside ip address it's going against and what inside ip it's comming from ??
We have a asa5510 with aprox 8 vlan's on the inside and it would be nice to see what user is causing the internet traffic and why there are so many hit's on the firewall  :-)
Thnks for any help
Thomas
pst not to good on command, mainly used gui :-)                  

Answer 1

Hi,
A basic packet capture configuration for ASA could look something like this
access-list TRAFFIC-CAPTURE permit ip 10.10.10.0 255.255.255.0 any
access-list TRAFFIC-CAPTURE permit ip any 10.10.10.0 255.255.255.0
capture TRAFFIC-CAPTURE type raw-data access-list TRAFFIC-CAPTURE interface inside buffer 33500000 circular-buffer
Where
TRAFFIC-CAPTURE = Is the ACL that defines the traffic to be captured. The above ACL captures both directions of the traffic when the source is 10.10.10.0/24 and destination is "any" (and vice versa naturally)
10.10.10.0/24 = Is an example LAN network located behind "inside" interface (or is the interface network)
inside = Is the interface from which the capture is taken from
33500000 = Is pretty close to the max buffer memory you can have on any ASA firewall for a single capture You can make separate capture for each direction and later attach the capture files using wireshark
circular-buffer = Is the setting that will permit the ASA to overwrite the old captured data when the buffer is full. Capture will keep on working but old data will be overwritten as new data is being captured.
Naturally the above ACL is VERY broad. You can change the capture to only capture one "host" traffic. Or only capture TCP or UDP traffic only. You can limit to some certain destination IP addresses. Just control as you like with the ACL.
To show if traffic is hitting the capture
show capture
To show a specific capture and its contents
show capture
To copy a capture to external TFTP server
     To be later opened with Wireshark for example
copy /pcap capture: tftp://x.x.x.x/.pcap
To remove a capture from ASA
Also removes the collected data
no capture
Hopefully the above information has been helpfull. Please do rate if it has been and naturally ask more if needed.
- Jouni