topic Re: ASA itself no connect to internet in Network Security

ASA itself no connect to internet

RobertoCervero — Fri, 21 Feb 2020 16:07:07 GMT

Greetings.

I have a problem with a firewall. The outside interface has a private IP 192.168.1.1 (192.168.1.0/24); the inside interface has public IP 66.66.228.2 (66.66.224.0/21).

The equipment of the subnet 66.66.224.0/21 can connect to the internet (if the ACLs allow it), but the firewall itself (66.66.228.2) is not capable.

I am trying to create a site-to-site VPN with another site and the firewall can not raise the tunnel because it can not communicate with the other end.

Could you help me?

Thanks in advance.
Roberto Cervero.

*not the real IPs

Re: ASA itself no connect to internet

mshaoaib — Fri, 17 Aug 2018 15:37:05 GMT

Hi Roberto,

Can you confirm whether there is a MAC address entry on the ASA for the default gateway, as well the machine having the gateway IP address has the MAC entry of ASA against the IP address 66.66.228.2. On the ASA you can confirm ARP entry with the help of the following command.

Show arp

Re: ASA itself no connect to internet

RobertoCervero — Sun, 19 Aug 2018 03:24:10 GMT

Hi!. Thank you for your answer.

Yes, there is a MAC entry for the default gateway on the ASA. I cannot confirm if there is a MAC entry of ASA in that machine because i have no control over it.
I guess there is because there is communication between both of them. I can make ping to this machine from ASA and it's answered

Thanks in advance.
Roberto Cervero.

Re: ASA itself no connect to internet

Marvin Rhoads — Sun, 19 Aug 2018 04:21:14 GMT

Your site-site VPN needs to connect to your ASA's outside address (or the NAT that the upstream gateway assigns to it).

You cannot connect a site-site VPN that is reached via the outside interface if it peers to the ASA inside address.