topic Re: CISCO ASA 5510 CONFIG PROBLEM! in Network Security

CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:25:30 GMT

Hello, i turned on afte a few weeks and it doesn't see internet.here's the show run

ciscoasa# show run
: Saved
:
: Serial Number: JMX1225L1LS
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 9.1(7)32
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.0.0.2 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
boot config disk0:/startup-1.cfg
ftp mode passive
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:adfe96de0173c0b922d5ee0831e5639e
: end
ciscoasa#

i must say that i havent changed anything and tried to copy the backup config from the flash.what's wrong?i use opendns.

Re: CISCO ASA 5510 CONFIG PROBLEM!

Rob Ingram — Wed, 23 Sep 2020 20:30:59 GMT

@antrikos_kal

Well for starters you don't have any NAT rules, so none of the internal clients will be able to access the internet.

Does the outside receive and DHCP IP address and a default route?

Can the ASA ping something on the internet?

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:37:15 GMT

can you please give me the commands? i lost all of my notes.i just turn it on today and had lost all the settings.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:38:51 GMT

i added ip address dhcpd setroute to outside and 10.0.0.2 to inside links and all are up.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:47:09 GMT

any help with all the necessary commands will be appreciated as i traumatized my right hand's muscle and can't type w/ both hands.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:49:36 GMT

i get internet w/ cable from the router to my smart tv and blu ray and laptop via 2 switches i get ip via dhcp i dont have static ip

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 20:50:53 GMT

i remember i gad 10.x.x.x range inside and 192.x.x.x outside.was working fine.

Re: CISCO ASA 5510 CONFIG PROBLEM!

Rob Ingram — Wed, 23 Sep 2020 20:55:41 GMT

object network INSIDE
 subnet 10.0.0.0 255.255.255.0
 nat (inside,outside) dynamic interface

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:12:30 GMT

under networks says unrecognized network while before was saying network and that's all tried to add ips to both outside inside

ciscoasa(config)# show run
: Saved
:
: Serial Number: JMX1225L1LS
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 9.1(7)32
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 10.0.0.69 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
boot config disk0:/startup-1.cfg
ftp mode passive
object network inside
subnet 10.0.0.0 255.255.255.0
pager lines 24
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network inside
nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:03bd11bcd6294affe80dd7cd7243226a
: end
ciscoasa(config)#

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:14:26 GMT

ciscoasa(config)# show interface
Interface Ethernet0/0 "outside", is up, line protocol is up
Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is off
MAC address 0021.554f.35bc, MTU 1500
IP address 192.168.1.124, subnet mask 255.255.255.0
1039 packets input, 101152 bytes, 0 no buffer
Received 998 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
88 packets output, 7976 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 1 interface resets
0 late collisions, 0 deferred
7 input reset drops, 0 output reset drops, 0 tx hangs
input queue (blocks free curr/low): hardware (255/230)
output queue (blocks free curr/low): hardware (255/253)
Traffic Statistics for "outside":
1031 packets input, 81236 bytes
88 packets output, 6032 bytes
185 packets dropped
1 minute input rate 0 pkts/sec, 59 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 3 pkts/sec, 256 bytes/sec
5 minute output rate 0 pkts/sec, 20 bytes/sec
5 minute drop rate, 0 pkts/sec
Interface Ethernet0/1 "inside", is up, line protocol is up
Hardware is i82546GB rev03, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is off
MAC address 0021.554f.35bd, MTU 1500
IP address 10.0.0.69, subnet mask 255.255.255.0
212 packets input, 24836 bytes, 0 no buffer
Received 212 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
10 packets output, 4880 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 1 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops, 0 tx hangs
input queue (blocks free curr/low): hardware (255/252)
output queue (blocks free curr/low): hardware (255/254)
Traffic Statistics for "inside":
212 packets input, 21020 bytes
10 packets output, 4664 bytes
198 packets dropped
1 minute input rate 0 pkts/sec, 60 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 57 bytes/sec
5 minute output rate 0 pkts/sec, 15 bytes/sec
5 minute drop rate, 0 pkts/sec
Interface Ethernet0/2 "", is administratively down, line protocol is down
Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
Auto-Duplex, Auto-Speed
Input flow control is unsupported, output flow control is off
Available but not configured via nameif
MAC address 0021.554f.35be, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 1 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops, 0 tx hangs
input queue (blocks free curr/low): hardware (255/255)
output queue (blocks free curr/low): hardware (255/255)
Interface Ethernet0/3 "", is administratively down, line protocol is down
Hardware is i82546GB rev03, BW 100 Mbps, DLY 100 usec
Auto-Duplex, Auto-Speed
Input flow control is unsupported, output flow control is off
Available but not configured via nameif
MAC address 0021.554f.35bf, MTU not set
IP address unassigned
0 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 1 interface resets
0 late collisions, 0 deferred
0 input reset drops, 0 output reset drops, 0 tx hangs
input queue (blocks free curr/low): hardware (255/255)
output queue (blocks free curr/low): hardware (255/255)
Interface Management0/0 "", is administratively down, line protocol is up
Hardware is i82557, BW 100 Mbps, DLY 100 usec
Auto-Duplex(Full-duplex), Auto-Speed(100 Mbps)
Input flow control is unsupported, output flow control is unsupported
Available but not configured via nameif
MAC address 0021.554f.35c0, MTU not set
IP address unassigned
45 packets input, 0 bytes, 0 no buffer
Received 0 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
0 packets output, 0 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 babbles, 0 late collisions, 0 deferred
0 lost carrier, 0 no carrier
0 input reset drops, 0 output reset drops
input queue (curr/max packets): hardware (0/0) software (0/0)
output queue (curr/max packets): hardware (1/0) software (0/0)
ciscoasa(config)#

Re: CISCO ASA 5510 CONFIG PROBLEM!

Rob Ingram — Wed, 23 Sep 2020 21:18:28 GMT

Provide the output of the following:-

show route
show interface ip brief
show nat detail

You've change the IP address of the inside interface, are the client computers using 10.0.0.69 as their default gateway? Do they have DNS configured?

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:22:10 GMT

dns on cisco is not configured as for the laptop it gives via dhcp ip.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:23:58 GMT

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
* - candidate default, U - per-user static route, o - ODR
P - periodic downloaded static route

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

C 10.0.0.0 255.255.255.0 is directly connected, inside
C 192.168.1.0 255.255.255.0 is directly connected, outside
d* 0.0.0.0 0.0.0.0 [1/0] via 192.168.1.1, outside
ciscoasa(config)#

ciscoasa(config)# show interface ip brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 192.168.1.124 YES DHCP up up
Ethernet0/1 10.0.0.69 YES manual up up
Ethernet0/2 unassigned YES unset administratively down down
Ethernet0/3 unassigned YES unset administratively down down
Internal-Control0/0 127.0.1.1 YES unset up up
Internal-Data0/0 unassigned YES unset up up
Management0/0 unassigned YES unset administratively down up

Auto NAT Policies (Section 2)
1 (inside) to (outside) source dynamic inside interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 10.0.0.0/24, Translated: 192.168.1.124/24

Re: CISCO ASA 5510 CONFIG PROBLEM!

Rob Ingram — Wed, 23 Sep 2020 21:25:43 GMT

You've not provided the information I asked for, this will help me determine where the issue may lie.

I am not interested in how the laptop receives the IP address, I want to confirm whether they have the correct default gateway and whether they have the correct DNS settings.

Can the client computers ping 10.0.0.69?

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:27:14 GMT

my sincere apologies for troubling you with such stupid questions but i had an accident and i have blackouts and was at the hospital for over a month.i almost forgot the most things i knew.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:29:58 GMT

if that helps you a cable from the router goes to one switch then a cable to another switch and a cable from switch to outside of the asa, the inside of asa comes from the 2nd switch.i haven't changed anything in the hardware conf it takes ips via dhcp from router.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:31:45 GMT

yes it successfuly pings 10.0.0.69

Re: CISCO ASA 5510 CONFIG PROBLEM!

Rob Ingram — Wed, 23 Sep 2020 21:45:57 GMT

Nothing has hit the NAT rule, which implies that traffic never reaches the ASA in the first place.

Is 10.0.0.69 the default gateway on the laptops or not? If the ASA on ip address 10.0.0.69 is not the default gateway that would explain why nothing has matched the NAT rule.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 21:38:32 GMT

anyway because it's too late in Greece, can you please tell me how to reset to factory defaults?i will start from the scratch in the morning.

Re: CISCO ASA 5510 CONFIG PROBLEM!

antrikos_kal — Wed, 23 Sep 2020 22:37:06 GMT

w/ the following config i did from scratch it says and sees network but no internet access.

asa(config)# show run
: Saved
:
: Serial Number: JMX1225L1LS
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 9.1(7)32
!
hostname asa
domain-name cisco.com
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
duplex full
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/1
duplex full
nameif inside
security-level 100
ip address 10.1.1.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
management-only
shutdown
nameif management
security-level 100
no ip address
!
ftp mode passive
dns server-group DefaultDNS
domain-name cisco.com
object network inside
subnet 10.0.0.0 255.255.255.0
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network inside
nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
http 10.1.1.2 255.255.255.255 management
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 208.67.222.222 208.67.220.220
dhcpd ping_timeout 750
!
dhcpd address 10.1.1.32-10.1.1.63 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
Cryptochecksum:f8ae89ad8584caafbfa764f831ee49c2
: end
asa(config)#