Cisco ASA – show local-host, show nat, show conn, clear conn

Cisco ASA connection related commands

Cisco ASA commands - techpain.com

Some useful commands for troubleshooting connections on a Cisco ASA – How to show and clear existing connections, show NAT details, and more.

show local-host all

This command shows local host connections grouped by interface, like so:

hostname# show local-host all
Interface outside: 1 active, 2 maximum active, 0 denied
local host: ,
TCP flow count/limit = 0/unlimited
TCP embryonic count to host = 0
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Conn:
105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464
105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464
Interface inside: 1 active, 2 maximum active, 0 denied
local host: ,
TCP flow count/limit = 0/unlimited
TCP embryonic count to host = 0
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Conn:
105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464
105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464
Interface NP Identity Ifc: 2 active, 4 maximum active, 0 denied
local host: ,
TCP flow count/limit = 0/unlimited
TCP embryonic count to host = 0
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Conn:
105 out 11.0.0.4 in 11.0.0.3 idle 0:01:44 bytes 4464
105 out 11.0.0.4 in 11.0.0.3 idle 0:01:42 bytes 4464
local host: ,
TCP flow count/limit = 0/unlimited
TCP embryonic count to host = 0
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Conn:
105 out 17.3.8.2 in 17.3.8.1 idle 0:01:44 bytes 4464
105 out 17.3.8.2 in 17.3.8.1 idle 0:01:42 bytes 4464
hostname# show local-host 10.1.1.91
Interface third: 0 active, 0 maximum active, 0 denied
Interface inside: 1 active, 1 maximum active, 0 denied
local host: ,
TCP flow count/limit = 1/unlimited
TCP embryonic count to (from) host = 0 (0)
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Xlate:
PAT Global 192.150.49.1(1024) Local 10.1.1.91(4984)
Conn:
TCP out 192.150.49.10:21 in 10.1.1.91:4984 idle 0:00:07 bytes 75 flags UI Interface
outside: 1 active, 1 maximum active, 0 denied
hostname# show local-host 10.1.1.91 detail
Interface third: 0 active, 0 maximum active, 0 denied
Interface inside: 1 active, 1 maximum active, 0 denied
local host: ,
TCP flow count/limit = 1/unlimited
TCP embryonic count to (from) host = 0 (0)
TCP intercept watermark = unlimited
UDP flow count/limit = 0/unlimited
Xlate:
TCP PAT from inside:10.1.1.91/4984 to outside:192.150.49.1/1024 flags ri
Conn:
TCP outside:192.150.49.10/21 inside:10.1.1.91/4984 flags UI Interface outside: 1 active, 1
maximum active, 0 denied

More details on this command can be found at Cisco.com’s ASA command reference

show conn, clear conn

The ‘show conn’ command show active connection, and the ‘clear conn’ command will remove those connections. This can be useful if you need to reset a connection because your configuration has changed. Here are some examples:

ASA-host1# clear conn ?

address Enter this keyword to specify IP address
all Enter this keyword to clear all conns
port Enter this keyword to specify port
protocol Enter this keyword to specify conn protocol
security-group Enter this keyword to specify security-group attributes
user Enter this keyword to specify conn user
user-group Enter this keyword to specify conn user group

ASA-host1# show conn address 192.168.0.2 | inc outside
TCP outside 8.9.10.11:24460 INT_NAME 192.168.0.2:443, idle 0:00:22, bytes 4827, flags UFRIOB
TCP outside 1.1.1.1:47166 INT_NAME 192.168.0.2:443, idle 0:00:41, bytes 6409, flags UFRIOB
TCP outside 1.2.3.4:1928 INT_NAME 192.168.0.2:443, idle 0:00:13, bytes 20147, flags UIOB
TCP outside 6.7.8.9:60002 INT_NAME 192.168.0.2:443, idle 0:01:02, bytes 6434, flags UFRIOB
TCP outside 9.12.10.11:443 INT_NAME 192.168.0.2:63079, idle 0:00:11, bytes 178430, flags UIO
TCP outside 6.4.5.3:443 INT_NAME 192.168.0.2:63464, idle 0:00:14, bytes 2830, flags UIO
TCP outside 7.4.7.4:443 INT_NAME 192.168.0.2:63426, idle 0:00:20, bytes 2709, flags UIO

ASA-host1# clear conn address 6.7.8.9 port 60002 address 192.168.0.2 port 443
1 connection(s) deleted.

ASA-host1# show conn address 192.168.0.2 | inc outside
TCP outside 8.9.10.11:24460 INT_NAME 192.168.0.2:443, idle 0:00:27, bytes 4827, flags UFRIOB
TCP outside 1.1.1.1:47166 INT_NAME 192.168.0.2:443, idle 0:01:12, bytes 6409, flags UFRIOB
TCP outside 1.2.3.4:1928 INT_NAME 192.168.0.2:443, idle 0:00:33, bytes 42223, flags UIOB
TCP outside 9.12.10.11:443 INT_NAME 192.168.0.2:63079, idle 0:00:42, bytes 178430, flags UIO
TCP outside 6.4.5.3:443 INT_NAME 192.168.0.2:63464, idle 0:00:26, bytes 7477, flags UIO
TCP outside 7.4.7.4:443 INT_NAME 192.168.0.2:63426, idle 0:01:24, bytes 2709, flags UIO

ASA-host1# clear conn address 1.1.1.1 port 47166 address 192.168.0.2 port 443
1 connection(s) deleted.

ASA-host1# show conn address 192.168.0.2 | inc outside
TCP outside 8.9.10.11:24460 INT_NAME 192.168.0.2:443, idle 0:01:30, bytes 4827, flags UFRIOB
TCP outside 1.2.3.4:1928 INT_NAME 192.168.0.2:443, idle 0:01:06, bytes 42223, flags UIOB
TCP outside 9.12.10.11:443 INT_NAME 192.168.0.2:63079, idle 0:00:18, bytes 188600, flags UIO
TCP outside 6.4.5.3:443 INT_NAME 192.168.0.2:63464, idle 0:00:00, bytes 12418, flags UIO

ASA-host1# clear conn address 8.9.10.11 port 24460 address 192.168.0.2 port 443
1 connection(s) deleted.

ASA-host1# clear conn address 192.168.0.2 port 443
2 connection(s) deleted.

ASA-host1# show conn address 192.168.0.2 | inc outside
TCP outside 9.12.10.11:443 INT_NAME 192.168.0.2:63079, idle 0:00:18, bytes 198807, flags UIO
TCP outside 6.4.5.3:443 INT_NAME 192.168.0.2:63464, idle 0:00:13, bytes 22300, flags UIO

show nat

This will show nat statistics, and hits for the NAT rules

show xlate

Shows current translated connections

Share

ICMP on Cisco ASA/PIX 7.x

Inbound ICMP through the PIX/ASA is denied by default. Outbound ICMP is permitted, but the incoming reply is denied by default.

Pings Inbound
Pings initiated from the outside, or another low security interface of the PIX, are denied be default. The pings can be allowed by the use of static and access lists or access lists alone. In this example, one server on the inside of the PIX is made accessible to external pings. A static translation is created between the inside address (10.1.1.5) and the outside address (192.168.1.5).

pix(config)#static (inside,outside) 192.168.1.5 10.1.1.5 netmask 255.255.255.255
pix(config)#access-list 101 permit icmp any host 192.168.1.5 echo
pix(config)#access-group 101 in interface outside

Pings Outbound
There are two options in PIX 7.x that allow inside users to ping hosts on the outside. The first option is to setup a specific rule for each type of echo message.

For example:

access-list 101 permit icmp any any echo-reply
access-list 101 permit icmp any any source-quench
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any time-exceeded
access-group 101 in interface outside

This allows only these return messages through the firewall when an inside user pings to an outside host. The other types of ICMP status messages might be hostile and the firewall blocks all other ICMP messages.

Another option is to configure ICMP inspection. This allows a trusted IP address to traverse the firewall and allows replies back to the trusted address only. This way, hosts on all inside interfaces can ping hosts on the outside and the firewall allows the replies to return. This also gives you the advantage of monitoring the ICMP traffic that traverses the firewall. In this example, icmp inspection is added to the default global inspection policy.

For example:

policy-map global_policy
class inspection_default
inspect icmp


Pulled from Cisco.com

Share

Share

WSUS and Firewalls

Configure the Firewall Between the WSUS Server and the Internet
http://technet.microsoft.com/en-us/l…05(WS.10).aspx

If there is a corporate firewall between WSUS and the Internet, you might need to configure the firewall to ensure that WSUS can obtain updates. To obtain updates from Microsoft Update, the WSUS server uses port 80 for HTTP protocol and port 443 for HTTPS protocol. This is not configurable.
If your organization does not allow those ports and protocols open to all addresses, you can restrict access to only the following domains so that WSUS and Automatic Updates can communicate with Microsoft Update:

  • http://windowsupdate.microsoft.com
  • http://*.windowsupdate.microsoft.com
  • https://*.windowsupdate.microsoft.com
  • http://*.update.microsoft.com
  • https://*.update.microsoft.com
  • http://*.windowsupdate.com
  • http://download.windowsupdate.com
  • http://download.microsoft.com
  • http://*.download.windowsupdate.com
  • http://ntservicepack.microsoft.com
  • http://wustat.windows.com

A big thanks to Jim Bengtson for the post at LinuxQuestions.org

Share

Share