ASA CAPTURE USER TRAFFIC FROM FIREWAL
===================================================================================================================================
Collect captures on the ASA for further analysis for the specific user IP following the below procedure
1. Apply captures
#cap capout interface outside buffer 33554432 circular-buffer match tcp host A.B.C.D host 12.182.253.167
#cap capdmz interface dmz buffer 33554432 circular-buffer match tcp host A.B.C.D host 192.168.200.167
#cap asp type asp-drop all circular-buffer buffer 33554432
2. Clear the captures
Clear cap /all
3. Wait when the user gets disconnected and stop the captures
no cap capout interface outside
no cap capdmz interface dmz
no cap asp type asp-drop all
Note the timestamp when the user got disconnected and provide me with the exact time
4. Collect the captures via TFTP or FTP
copy /pcap capture:capout ftp://anonymous:cisco@173.37.146.14/TAC--636095055-capout.pcap
copy /pcap capture:capdmz ftp://anonymous:cisco@173.37.146.14/TAC--636095055-capdmz.pcap
copy /pcap capture:asp ftp://anonymous:cisco@173.37.146.14/TAC--636095055-asp.pcap
5. Collect asp captures in text format
Sh cap asp | i 12.182.253.167
Sh cap asp | i 192.168.200.167
Sh cap asp | i A.B.C.D
6. It would be great if you also collect the syslogs from the ASA at the time when the issue happen
===================================================================================================================
| Disclaimer: This communication is for the exclusive use of the intended recipient(s) and shall not attach any liability on the originator or ITC Infotech India Ltd./its Holding company/ its Subsidiaries/ its Group Companies. If you are the addressee, the contents of this e-mail are intended for your use only and it shall not be forwarded to any third party, without first obtaining written authorization from the originator or ITC Infotech India Ltd./ its Holding company/its Subsidiaries/ its Group Companies. It may contain information which is confidential and legally privileged and the same shall not be used or dealt with by any third party in any manner whatsoever without the specific consent of ITC Infotech India Ltd./ its Holding company/ its Subsidiaries/ its Group Companies. |
