phant
Зарегистрирован: 15 июл 2017, 21:08 Сообщения: 70
|
ЦО + филиал .... впн канал поднят, Из центрального филиала не ходят пакеты в одну из подсетей филиала удаленного... вывод Пакет трасерта packet-tracer in INSIDE icmp 10.1.22.135 0 0 10.2.23.10 det
Phase: 1 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 0.0.0.0 0.0.0.0 Alpha
Phase: 2 Type: UN-NAT Subtype: static Result: ALLOW Config: nat (INSIDE,OUTSIDE) source static SLS SLS destination static group-php group-php Additional Information: NAT divert to egress interface OUTSIDE Untranslate 10.2.23.10/0 to 10.2.23.10/0
Phase: 3 Type: ROUTE-LOOKUP Subtype: input Result: ALLOW Config: Additional Information: in 10.1.0.0 255.255.128.0 S3
Phase: 4 Type: ACCESS-LIST Subtype: log Result: ALLOW Config: access-group INSIDE in interface INSIDE access-list OUTSIDE extended permit icmp object-group SLS any4 access-list INSIDE remark -=SSL VPN=- object-group network SLS description: -=SLS network=- network-object 192.168.0.0 255.255.248.0 network-object 10.1.0.0 255.255.128.0 network-object 10.3.255.0 255.255.255.0 network-object 192.11.13.0 255.255.255.0 network-object 10.3.1.0 255.255.255.0 Additional Information: Forward Flow based lookup yields rule: in id=0x7fffa4b31f10, priority=13, domain=permit, deny=false hits=138239459, user_data=0x7fffa0265d40, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=10.1.0.0, mask=255.255.128.0, icmp-type=0, tag=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0 input_ifc=S3, output_ifc=any Phase: 5 Type: NAT Subtype: Result: ALLOW Config: nat (INSIDE,OUTSIDE) source static SLS SLS destination static group-php group-php Additional Information: Static translate 10.1.22.135/0 to 10.1.22.135/0 Forward Flow based lookup yields rule: in id=0x7fffa83a7320, priority=6, domain=nat, deny=false hits=96667, user_data=0x7fffa46da530, cs_id=0x0, flags=0x0, protocol=0 src ip/id=10.1.0.0, mask=255.255.128.0, port=0, tag=0 dst ip/id=10.2.23.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0 input_ifc=INSIDE, output_ifc=OUTSIDE
Phase: 6 Type: NAT Subtype: per-session Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0x7fffa363cae0, priority=0, domain=nat-per-session, deny=true hits=628346596, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0 input_ifc=any, output_ifc=any
Phase: 7 Type: IP-OPTIONS Subtype: Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0x7fffa43490b0, priority=0, domain=inspect-ip-options, deny=true hits=1047783653, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0 input_ifc=INSIDE, output_ifc=any
Phase: 8 Type: INSPECT Subtype: np-inspect Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0x7fffa43489e0, priority=66, domain=inspect-icmp-error, deny=false hits=101194937, user_data=0x7fffa4347f50, cs_id=0x0, use_real_addr, flags=0x0, protocol=1 src ip/id=0.0.0.0, mask=0.0.0.0, icmp-type=0, tag=0 dst ip/id=0.0.0.0, mask=0.0.0.0, icmp-code=0, tag=0, dscp=0x0 input_ifc=S3, output_ifc=any
Phase: 9 Type: FLOW-EXPORT Subtype: Result: ALLOW Config: Additional Information: Forward Flow based lookup yields rule: in id=0x7fffa603f480, priority=18, domain=flow-export, deny=false hits=928560102, user_data=0x7fffa5c4a430, cs_id=0x0, use_real_addr, flags=0x0, protocol=0 src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0 dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0 input_ifc=INSIDE, output_ifc=any
Phase: 10 Type: VPN Subtype: encrypt Result: DROP Config: Additional Information: Forward Flow based lookup yields rule: out id=0x7fffa47e8550, priority=70, domain=encrypt, deny=false hits=94238, user_data=0x0, cs_id=0x7fffaa5c1520, reverse, flags=0x0, protocol=0 src ip/id=10.1.0.0, mask=255.255.128.0, port=0, tag=0 dst ip/id=10.2.23.0, mask=255.255.255.0, port=0, tag=0, dscp=0x0 input_ifc=any, output_ifc=Alpha
Result: input-interface: INSIDE input-status: up input-line-status: up output-interface: OUTSIDE output-status: up output-line-status: up Action: drop Drop-reason: (acl-drop) Flow is denied by configured rule
Уже натыкался не понятно почему пакеты не идут...
|