ASA 5505阻塞业务

Question

这5505阻塞了进出的交通。我已经向好的IT人员寻求帮助，他们说它看起来是正确配置的。一周前起作用了。我在这里展示配置。如果有人能帮忙的话，我会很感激的。

CrazyQASA# show running-config
: Saved
:
ASA Version 8.2(5)
!
terminal width 300
hostname CrazyQASA
domain-name CrazyQ.com

names
!
interface Ethernet0/0
 switchport access vlan 2
!

interface Vlan1
 nameif inside
 security-level 100
 ip address 10.60.81.1 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 198.121.179.194 255.255.255.248
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 209.32.32.32
 name-server 206.8.8.8
 domain-name crazq.com
object-group service rdp3390 tcp
 port-object eq 3390
access-list inboundtraffic extended permit tcp any interface outside eq pptp
CrazyQASA# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 40/40/40 ms
CrazyQASA# ping 10.60.81.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.60.81.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms
CrazyQASA# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
   D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
   N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
   E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
   i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
   * - candidate default, U - per-user static route, o - ODR
   P - periodic downloaded static route

Gateway of last resort is 198.121.179.194 to network 0.0.0.0

C    198.121.179.192 255.255.255.248 is directly connected, outside
C    10.60.81.0 255.255.255.0 is directly connected, inside
S*   0.0.0.0 0.0.0.0 [1/0] via 198.121.179.194, outside
CrazyQASA#

Answer 1

您可以使用数据包跟踪器命令来解决这个问题。您可以指定要排除故障的流量的特征，它将根据ASA的配置来评估流量，告诉您，如果流量确实击中了ASA，会发生什么情况。

思科论坛文章，描述包跟踪器

Answer 2

这是一个网络ARP问题，而不是思科问题。为了修复它，我们强制MAC地址与它不同(在NIC上)，然后重新启动机器，然后将它更改为NIC上的内容。这个解决了所有的问题。VPN开始工作，DNS开始工作，每个人都很高兴。对不起，我还没有完全解释这一切的原因，但它起了作用。