{"id":362,"date":"2010-01-26T14:22:26","date_gmt":"2010-01-26T14:22:26","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2010\/01\/26\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa\/"},"modified":"2023-01-15T22:39:37","modified_gmt":"2023-01-15T22:39:37","slug":"what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html","title":{"rendered":"What is ASP and how do I troubleshoot ASP drops on an ASA ?"},"content":{"rendered":"

What is the Accelerated Security Path ?<\/strong><\/p>\n

The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session Management Path. In addition to the Accelerated Security Paths there is also the Control Plane Path which is also covered below.<\/p>\n

The Session Management Path<\/span><\/p>\n

When a new connection reaches the ASA gateway the first packet is sent to the \u201cSession Management Path\u201d.\u00a0 This path is responsible for<\/p>\n

* Performing the access list checks
\n* Performing route lookups
\n* Allocating NAT translations (xlates)
\n* Establishing sessions in the “fast path”<\/p>\n

The Fast Path<\/span><\/p>\n

If the connection is already established, the security appliance does not need to re-check packets and the packets are sent to the Fast Path. The Fast Path is responsible for the following tasks:<\/p>\n

* IP checksum verification
\n* Session lookup
\n* TCP sequence number check
\n* NAT translations based on existing sessions
\n* Layer 3 and Layer 4 header adjustments<\/p>\n

For UDP or other connectionless protocols, the security appliance creates connection state information so that it can also use the fast path.<\/p>\n

Some established session packets must continue to go through the session management path or the control plane path. Generally packets that require HTTP packet inspection or content filtering will go through to the session management. Packets that go through the control plane path include the control packets for protocols that require Layer 7 inspection. But Data packets for protocols that require Layer 7 inspection can still go through the Fast Path.<\/p>\n

The Control Plane Path<\/span><\/p>\n

Some packets which require adjustments or changes to be made to the packets headers at a Layer 7 level. Or Layer 7 inspection engines which are required for dynamic port based protocols such as FTP and H.323 etc\u00a0 are passed to the Control Plane Path.<\/p>\n

How do I Debug ASP Drops ?
\n<\/strong><\/p>\n

There are 3 main ways to confirm whether your ASA appliance has dropped packets at the ASP stage. These are:<\/p>\n

1. Viewing the ASP statistics
\n2. Viewing the ASA Logs
\n3. Running an ASP Drop packet capture<\/p>\n

Viewing the ASP statistics<\/span><\/p>\n

In order to view the ASP drop statistics you can run the command \u201csh asp drop\u201d.<\/p>\n

asa-firewall# sh asp drop\r\nFrame drop:\r\n\u00a0 Invalid TCP Length (invalid-tcp-hdr-length)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 20\r\n\u00a0 First TCP packet not SYN (tcp-not-syn)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 902518\r\n\u00a0 Bad TCP flags (bad-tcp-flags)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 39\r\nLast clearing: 19:45:39 UTC Jan 18 2010 by user\r\nFlow drop:\r\n\u00a0 NAT failed (nat-failed)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 218\r\n\u00a0 Inspection failure (inspect-fail)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 29170\r\n\u00a0 SSL received close alert (ssl-received-close-alert)\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 4\r\n\u00a0\r\nLast clearing: 19:45:39 UTC Jan 18 2010 by user<\/pre>\n

This will give you an overview view of the type of drops being encountered. But does not provided the necessary information to isolate and troubleshoot particular hosts.<\/p>\n

You can also clear these counters using the clear asp drop command.<\/p>\n

Viewing the ASA Logs<\/span><\/p>\n

Via your Syslog server you will be able to view the logs showing the dropped connections. This will provide the reason along with the source and destination addresses. An example is shown below for an MSS Excedded<\/a> ASP drop,<\/p>\n

%ASA-4-419001: Dropping TCP packet from outside:192.168.9.2\/80 to inside:192.168.9.30\/1025, rea\r\nson: MSS exceeded, MSS 460, data 1440<\/pre>\n

Running an ASP drop packet capture<\/span><\/p>\n

This is in my opinion the most concise and efficient way of troubleshooting your ASP dropped traffic.
\nTo enable a packet capture on all traffic for all asp-drop types use the following command :<\/p>\n

asa-firewall# capture asp-drop type asp-drop all<\/pre>\n

To then see your buffer for the asp-drop capture run the following command. You can see from the highlighted sections the reason for the drop.<\/p>\n

asa-firewall# sh capture asp-drop<\/pre>\n

2 packets captured
\n1: 15:15:00.682154 197.2.1.29.2616 > 87.200.42.101.443: S 1239395083:1239395083(0) win 65535 <mss 1260,nop,nop,sackOK> Drop-reason: (acl-drop) Flow is denied by configured rule<\/strong>
\n4: 15:15:00.750830 10.70.0.162.3812 > 168.252.3.41.15: S 3523756300:3523756300(0) win 65535 <mss 1360,nop,nop,sackOK> Drop-reason: (rpf-violated) Reverse-path verify failed<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session Management Path. In addition to the Accelerated Security Paths there is also the Control Plane Path which is also covered below. The Session Management Path When a new connection … Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"yoast_head":"\nWhat is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net<\/title>\n<meta name=\"description\" content=\"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"What is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net\" \/>\n<meta property=\"og:description\" content=\"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\" \/>\n<meta property=\"og:site_name\" content=\"Fir3net\" \/>\n<meta property=\"article:published_time\" content=\"2010-01-26T14:22:26+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-15T22:39:37+00:00\" \/>\n<meta name=\"author\" content=\"Rick Donato\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rick Donato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\"},\"author\":{\"name\":\"Rick Donato\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\"},\"headline\":\"What is ASP and how do I troubleshoot ASP drops on an ASA ?\",\"datePublished\":\"2010-01-26T14:22:26+00:00\",\"dateModified\":\"2023-01-15T22:39:37+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\"},\"wordCount\":535,\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"articleSection\":[\"Cisco Firewalls\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\",\"url\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\",\"name\":\"What is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/#website\"},\"datePublished\":\"2010-01-26T14:22:26+00:00\",\"dateModified\":\"2023-01-15T22:39:37+00:00\",\"description\":\"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session\",\"breadcrumb\":{\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.fir3net.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\/\/www.fir3net.com\/security\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Firewalls\",\"item\":\"https:\/\/www.fir3net.com\/security\/firewalls\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Cisco Firewalls\",\"item\":\"https:\/\/www.fir3net.com\/security\/firewalls\/cisco\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"What is ASP and how do I troubleshoot ASP drops on an ASA ?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.fir3net.com\/#website\",\"url\":\"https:\/\/www.fir3net.com\/\",\"name\":\"Fir3net\",\"description\":\"Keeping you in the know\",\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.fir3net.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.fir3net.com\/#organization\",\"name\":\"Fir3net\",\"url\":\"https:\/\/www.fir3net.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"width\":390,\"height\":88,\"caption\":\"Fir3net\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\",\"name\":\"Rick Donato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"caption\":\"Rick Donato\"},\"description\":\"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"What is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net","description":"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html","og_locale":"en_US","og_type":"article","og_title":"What is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net","og_description":"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session","og_url":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html","og_site_name":"Fir3net","article_published_time":"2010-01-26T14:22:26+00:00","article_modified_time":"2023-01-15T22:39:37+00:00","author":"Rick Donato","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rick Donato","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#article","isPartOf":{"@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html"},"author":{"name":"Rick Donato","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037"},"headline":"What is ASP and how do I troubleshoot ASP drops on an ASA ?","datePublished":"2010-01-26T14:22:26+00:00","dateModified":"2023-01-15T22:39:37+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html"},"wordCount":535,"publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"articleSection":["Cisco Firewalls"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html","url":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html","name":"What is ASP and how do I troubleshoot ASP drops on an ASA ? - Fir3net","isPartOf":{"@id":"https:\/\/www.fir3net.com\/#website"},"datePublished":"2010-01-26T14:22:26+00:00","dateModified":"2023-01-15T22:39:37+00:00","description":"What is the Accelerated Security Path ? The Accelerated Security Path (ASP) on the ASA appliance comprises of 2 components; The Fast Path and The Session","breadcrumb":{"@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.fir3net.com\/Cisco-ASA\/what-is-asp-and-how-to-troubleshoot-asp-drops-on-an-asa.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fir3net.com\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.fir3net.com\/security"},{"@type":"ListItem","position":3,"name":"Firewalls","item":"https:\/\/www.fir3net.com\/security\/firewalls"},{"@type":"ListItem","position":4,"name":"Cisco Firewalls","item":"https:\/\/www.fir3net.com\/security\/firewalls\/cisco"},{"@type":"ListItem","position":5,"name":"What is ASP and how do I troubleshoot ASP drops on an ASA ?"}]},{"@type":"WebSite","@id":"https:\/\/www.fir3net.com\/#website","url":"https:\/\/www.fir3net.com\/","name":"Fir3net","description":"Keeping you in the know","publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fir3net.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.fir3net.com\/#organization","name":"Fir3net","url":"https:\/\/www.fir3net.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","width":390,"height":88,"caption":"Fir3net"},"image":{"@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037","name":"Rick Donato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","caption":"Rick Donato"},"description":"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders."}]}},"_links":{"self":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/362"}],"collection":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/comments?post=362"}],"version-history":[{"count":1,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/362\/revisions"}],"predecessor-version":[{"id":3544,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/362\/revisions\/3544"}],"wp:attachment":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media?parent=362"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/categories?post=362"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/tags?post=362"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}