Troubleshooting PIX access-lists?

[dkraut]

What are some good tools/methods for troubleshooting PIX access-list issues? For example, say that we're blocking all outbound smtp after allowing all of our email servers smtp access (as noted in sample below). The email admin stops by one morning and says that he can no longer send smtp to external clients from email server 172.28.12.16 but but the server has tested OK. How can I verify that smtp traffic is or is not showing up at the internal pix interface and passing thru the pix to external clients?

sample access-list >>

access-list net_in permit tcp host 172.28.12.38 any eq smtp
access-list net_in permit tcp host 172.28.12.16 any eq smtp
access-list net_in permit tcp host 172.28.12.12 any eq smtp
access-list net_in permit tcp host 172.28.12.14 any eq smtp
access-list net_in deny tcp any any eq smtp
access-list net_in permit ip any any

Scenario 2.

I allow

http://www access

from outside interface to several internal web servers but one day web admin says that "web server3" is no longer responding to

http://www from

outside requests but is responding to

http://www via

internal requests?

sample access-list =


static (inside,outside) 12.31.208.195 172.28.12.5 netmask 255.255.255.255 0 0
static (inside,outside) 12.31.208.196 172.28.12.6 netmask 255.255.255.255 0 0
static (inside,outside) 12.31.208.197 172.28.12.16 netmask 255.255.255.255 0 0
access-list inbound permit tcp any host 12.31.208.195 eq www
access-list inbound permit tcp any host 12.31.208.196 eq www
access-list inbound permit tcp any host 12.31.208.197 eq smtp


I need a way to quickly troubleshoot these type of issues either via Telnet "CLI" or the PDM.

Thoughts? TIA!

 

[308win]

To see if traffic is reaching the pix you can use the sho access-list command. Make some traffic and look at the counters to see if they are incrementing. If your access list is host or protocol specific as yours appears to be then it should be fairly easy to verify.

A packet capture on the downstream side will, without a doubt, allow you to verify that traffic has left the pix. Very careful use of the debug packet command will also allow you to watch traffic leave the pix. You'll have to decide if it is appropriate to use in your case. Filtered on a known source IP address accessing a specific web server is probably ok to do, filtering on all SMTP traffic is probably a bad idea.

 

[bytehd]

without an access-group command, they dont work

http://www.insyncva.com

 

[dkraut]

Regarding the access-group command - good observation. I should have included it in my samples above as >>

access-group inbound in interface outside
access-group net_in in interface inside

 

[bytehd]

6.3 also has a capture command

http://www.insyncva.com