Always Geeky | Cisco ASA

Category Archives Cisco ASA
ERROR: Cannot remove connected route

Posted on December 4, 2013 10:43 am by scott Comment

firewall-asa(config)# no route INSIDE 192.168.0.0 255.255.255.0 172.16.0.254 ERROR: Cannot remove connected route firewall-asa(config)#

The above error is caused when you try to route a directly connected interface to another subnet. In order to remove this route, you need to shutown the interface, then remove the route.

For example, if you have 172.16.0.0/24 assigned to your INSIDE interface, and 192.168.0.0/24 routed to an IP within 172.16.0.0, and you want to move 192.168.0.0/24 to a dedicated segment on the FW (say DMZ), you will run into this problem. You need to shutdown the INSIDE segment in order to remove the route.

firewall-asa(config)# interface Ethernet0/1 firewall-asa(config-subif)# shut firewall-asa(config-subif)# exit firewall-asa(config)# firewall-asa(config)# no route INSIDE 192.168.0.0 255.255.255.0 172.16.0.254 firewall-asa(config)# firewall-asa(config)# interface Ethernet0/1.100 firewall-asa(config-subif)# no shut

Problem solved.

This entry was posted in Cisco ASA and tagged ASA 8.0, cisco asa, firewall, routing, static route. Bookmark the permalink.
Show sysopt configuration on ASA

Posted on June 27, 2013 10:09 pm by scott Comment

The normal commands to show configuration items don’t work as expected for sysopt.

asa/pri/act# sh run sysopt asa/pri/act#
asa/pri/act# sh run | include sysopt asa/pri/act#
asa/pri/act# more system:running-config | include sysopt asa/pri/act#

You need to use the “show run all sysopt” command.

asa/pri/act# show run all sysopt no sysopt connection timewait sysopt connection tcpmss 1380 sysopt connection tcpmss minimum 0 no sysopt nodnsalias inbound no sysopt nodnsalias outbound no sysopt radius ignore-secret sysopt connection permit-vpn no sysopt connection reclassify-vpn no sysopt connection preserve-vpn-flows asa/pri/act#

This entry was posted in Cisco ASA, Firewalls and tagged sysopt. Bookmark the permalink.

ERROR: ACE contains port, protocol, or deny. Removing NAT configuration

Posted on March 7, 2013 10:22 pm by scott Comment

Never specific anything other than IP (such as TCP or UDP), when creating an ACL on the ASA for an ACL used within a NAT statement. If you do, you may get this error:

ERROR: ACE contains port, protocol, or deny. Removing NAT configuration

The above means that all of your NAT config has now been removed. Depending on your config, this can break a lot of traffic.

Here is an example:

ciscoasa/pri/act# show run nat

nat (outside) 0 access-list nat-exempt
nat (dmz) 0 access-list nat-exempt
nat (inside) 0 access-list nat-exempt

ciscoasa/pri/act#
ciscoasa/pri/act# sh run access-list nat-exempt

access-list nat-exempt extended permit ip 10.101.0.0 255.255.255.0 10.120.0.0 255.255.255.0

ciscoasa/pri/act# configure terminal
ciscoasa/pri/act(config)# access-list nat-exempt extended permit tcp 10.96.0.0
255.255.255.0 172.19.19.0 255.255.255.0 eq 80

ERROR: ACE contains port, protocol, or deny. Removing NAT configuration
nat (outside) 0 access-list nat-exempt
ERROR: ACE contains port, protocol, or deny. Removing NAT configuration
nat (dmz) 0 access-list nat-exempt
ERROR: ACE contains port, protocol, or deny. Removing NAT configuration
nat (inside) 0 access-list nat-exempt

ciscoasa/pri/act(config)# exit
ciscoasa/pri/act# 
ciscoasa/pri/act# show run nat
ciscoasa/pri/act#

Notice that the NAT rules were removed completely when we added the incorrect ACE. We need to replace them manually:

ciscoasa/pri/act(config)# no access-list nat-exempt extended permit tcp 10.96.0.0
255.255.255.0 172.19.19.0 255.255.255.0 eq 80

ciscoasa/pri/act(config)# nat (outside) 0 access-list nat-exempt
ciscoasa/pri/act(config)# nat (dmz) 0 access-list nat-exempt
ciscoasa/pri/act(config)# nat (inside) 0 access-list nat-exempt

This entry was posted in Cisco ASA and tagged ASA 8.0, nat, nat exemption, nat-control. Bookmark the permalink.

Packet-tracer issues with a multi-context ASA

Posted on October 10, 2012 9:57 pm by scott Comment

Why does packet-tracer sometimes work when used within a multi-context environment, but sometimes not work? It can seem rather random as to the success, but it is actually quite predictable, once you know why it does fail when it does.

Packet-tracer simulates a packet arriving on an interface, and the internal path taken to either drop the packet or send it out an interface, without actually sending the packet.

Multi-context firewalls allow you to run discrete virtual firewalls on a single hardware device – much like virtualization.

The problem with packet-tracer is a simulated packet arriving on a shared interface. Input parameters for the packet-tracer command are limited to layer 3/4, being the source & destination IP address, and the source & destination port. If you have a shared interface on the device, real incoming packets will be sent to the correct context based on the destination MAC address. Packet-tracer does not allow you to specify a destination (nor a source) MAC address, therefore it does not know which context to send the packet to.

This entry was posted in Cisco ASA and tagged cisco asa, firewall, multi-context, packet-tracer. Bookmark the permalink.

ERROR: Cannot remove connected route

Show sysopt configuration on ASA

ERROR: ACE contains port, protocol, or deny. Removing NAT configuration

Packet-tracer issues with a multi-context ASA