Packet-Tracer Fails Subtype: rpf-check Result: DROP
Nov17

Packet-Tracer Fails Subtype: rpf-check Result: DROP

KB ID 000904  Problem I love packet-tracer, I use it a lot, especially when I’ve been told that the firewall I’ve installed is stopping a particular port. I had set up a simple port forward the other day, and when I went to check it with packet-tracer this happened. Petes-ASA# packet-tracer input outside tcp 123.123.123.123 443 192.168.1.10 443 <——-Output removed——–> Phase: 7 Type: NAT...

Read More
CentOS – Setup the iptables Firewall
Nov17

CentOS – Setup the iptables Firewall

KB ID 0000938 Problem I was a little perturbed to find out the firewall on my CentOS web server was wide open today. My server setup notes yielded no clues, so it was time to put my ‘Linux Head’ on and fix it. Solution 1. Connect to the server via console or SSH. As I’m going to change the iptables config file lets back it up (always assume you are going to smash something!) cp /etc/sysconfig/iptables iptables.bak 2....

Read More
Cisco ASA (acl-drop) Flow is Denied by Configured Rule
Nov17

Cisco ASA (acl-drop) Flow is Denied by Configured Rule

KB ID 0001108  Problem Packet-tracer is a brilliant troubleshooting tool, but sometimes interpreting the output proves to be more difficult that actually fixing the problem. If your output fails at the access-list section this is the sort of thing you will see; Petes-ASA# packet-tracer input inside tcp 10.2.2.10 80 123.123.123.123 80 —-Output removed for the sake of brevity— Type: ACCESS-LIST Subtype: Result: DROP Config:...

Read More