topic Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside" in Network Security

Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 00:16:25 GMT

I am replacing a 5550 ASA on my home network with a Firepower 1120. I manually added the interfaces and such using similar naming conventions on the 5550. When I mouse over 1/1 I see the message box stating "Gateway cannot be reached through port Ethernet1/1 named "outside"". Looking for suggestions on what to check for.

This is shown with and without actual connection to the cable modem which is bridged.

> show ip

System IP Addresses:

Interface Name IP address Subnet mask

Method

Ethernet1/1 outside 208.104.20.30 255.255.255.0

CONFIG

Ethernet1/2 inside-original 192.168.104.1 255.255.255.0

CONFIG

Ethernet1/3 inside2 10.10.81.1 255.255.255.0

CONFIG

Ethernet1/4 inside3 192.168.1.1 255.255.255.0

CONFIG

Ethernet1/5 l3 10.10.103.254 255.255.255.0

CONFIG

Ethernet1/9 inside 192.168.103.1 255.255.255.0

CONFIG

Current IP Addresses:

Interface Name IP address Subnet mask

Method

Ethernet1/1 outside 208.104.20.30 255.255.255.0

CONFIG

Ethernet1/2 inside-original 192.168.104.1 255.255.255.0

CONFIG

Ethernet1/3 inside2 10.10.81.1 255.255.255.0

CONFIG

Ethernet1/4 inside3 192.168.1.1 255.255.255.0

CONFIG

Ethernet1/5 l3 10.10.103.254 255.255.255.0

CONFIG

Ethernet1/9 inside 192.168.103.1 255.255.255.0

CONFIG

> show network

===============[ System Information ]===============

Hostname : OsmondFPR1120

DNS Servers : 208.104.244.45

208.104.2.36

Management port : 8305

IPv4 Default route

Gateway : data-interfaces

==================[ management0 ]===================

State : Enabled

Channels : Management & Events

Mode : Non-Autonegotiation

MDI/MDIX : Auto/MDIX

MTU : 1500

MAC Address : 6C:03:09:ED:FF:80

----------------------[ IPv4 ]----------------------

Configuration : Manual

Address : 192.168.45.45

Netmask : 255.255.255.0

Broadcast : 192.168.45.255

----------------------[ IPv6 ]----------------------

Configuration : Disabled

===============[ Proxy Information ]================

State : Disabled

Authentication : Disabled

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

Marvin Rhoads — Fri, 11 Jun 2021 16:54:48 GMT

Does your ISP really give you a /24 as indicated in your configuration of Ethernet 1/1?

 208.104.20.30   255.255.255.0

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 17:43:26 GMT

I have three statics coming in via the cable modem. This is what I have on my 5550 now.

interface GigabitEthernet0/0

description outside

nameif outside

security-level 100

ip address 208.104.20.30 255.255.255.0

I was replicating what I have live on the 5550. The static for my gateway on the 5550 is

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 18:28:52 GMT

The other static IPs are 208.104.20.145 and 208.104.20.198 which I use NAT rules to handle to other inside IPs. For now I am just trying to get the 1120 able to connect outside and register it and of course make use of it in place of the 5550. When I look at the ARP table on the 5550 it shows 208.104.20.1 on the "outside" interface which is the gateway from the ISP.

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

Marvin Rhoads — Fri, 11 Jun 2021 18:52:36 GMT

OK, you should be able to get things going then if you put that gateway address in as the static default route for your system's dataplane. Your FDM GUI screenshot indicates you haven't configured any routes yet. (The default setup uses DHCP with setroute option.)

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 18:57:24 GMT

Is that not what this is?

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

Marvin Rhoads — Fri, 11 Jun 2021 19:34:25 GMT

Oh OK - I was going by the first screenshot which said no routes.

What's causing the Eth 1/1 interface status to be orange? Hovering over it should bring up a status tooltip.

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 19:42:32 GMT

Sorry about that, the screen shot was before I added the static. I was following the documentation and thought what I had should work. Right now the 1120 is not connected to the cable modem. When attached to the cable modem it will go green. I did power down the cable modem and the 1120 before moving from 5550 to the 1120. Even though it was green I got the same message about the gateway and ISP/WAN/Gateway box never changes colors (assuming it would). 1/9 which is my internal network goes green and all of the devices inside on the switch see each other but of course none can get outside. I get the message about the gateway even when attached to the cable modem. My daughter and I both work remote from home so need network up during business hours. Let me know what else you need to review and I can send a word doc with current screen shots. Thx

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Fri, 11 Jun 2021 19:49:12 GMT

Attached is screen shots of everything (I think).

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

johnlloyd_13 — Sat, 12 Jun 2021 02:29:55 GMT

hi,

your NAT is configured as STATIC. change it to DYNAMIC and also change under translated packet > source address > interface.

see helpful link:

https://ccnpsecuritywannabe.blogspot.com/2019/09/configuring-ftd-623-via-firepower.html

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

Marvin Rhoads — Sat, 12 Jun 2021 11:57:52 GMT

Like @johnlloyd_13 said - correct the NAT configuration and deploy.

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1 name "outside"

dposmondsr7367 — Sat, 12 Jun 2021 13:24:53 GMT

That worked. Thanks to @johnlloyd_13 and @Marvin Rhoads for the support on this!

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1

AmmarHermiz14196 — Sun, 14 Nov 2021 16:16:49 GMT

I have same issue but my NAT is on dynamic? Thanks

Re: Firepower 1120 Gateway cannot be reached through port Ethernet1/1

AmmarHermiz14196 — Mon, 15 Nov 2021 16:26:45 GMT

I have same issue but my NAT is on dynamic not static, and I still have same problem? Thanks

Ammar