topic Thanks for letting us know in Network Security

No Internet Access but connected to domain. New install of Windows 7

KYLE NGUYEN — Tue, 12 Mar 2019 08:14:50 GMT

Hi everyone

I have a problem that's driving me nuts trying to troubleshoot. Brand new install of Windows 7 Dell latitude. I'm connected to our domain, but cannot browse the Internet with exclamation icon and msg "No Internet Access."

I can ping all internal servers and gateway. No issues there.

I took the laptop home and connected to my home network fine. Internet connection works perfectly.

But when I get back to the office, I tried connecting with both wired and wireless, both gives msg "No Internet Access."

Firewall is ASA 5505. I did some googling, and found some info on IP Shunning, but when I check my firewall settings, shunning is not enabled.

Any help is greatly appreciated. Thanks.

Are all of your network

Marvin Rhoads — Thu, 08 Sep 2016 00:24:27 GMT

Are all of your network settings (IP address, DNS and domain name) set to "auto"?

When you have the failed connectivity, check "ipconfig /all" to see that you are getting everything you expect.

If that looks good, then check the firewall. First make sure traffic from your PC is reaching it (packet capture is easiest). Then make sure it is getting passed through and NATted like you expect (packet-tracer tool)

Hi,

KYLE NGUYEN — Thu, 08 Sep 2016 14:35:53 GMT

Hi,

yes. ipconfig /all shows all the right ip addresses.

I not all that familiar with ASA firewalls, so if you can walk me through setting up the packet capture I would really appreciate it.

Some new developments. so I connected the new laptop directly to the ASA firewall and I get an Internet Connection immediately. I can ping all internal servers and browse the internet.

If I plug it back into the Cisco switch I lose internet connection, but I'm still connected to the domain/network.

I tried setting up another new desktop and I'm getting the exact same issue. No Internet Access, but I can join domain and connect to all internal servers.

All other workstation already on the network is functioning like normal. No problems. It's only affecting any new machines I'm connecting to the network.

Any idea what's going on?

Here's how to do a packet

Marvin Rhoads — Thu, 08 Sep 2016 17:57:26 GMT

Here's how to do a packet trace on an ASA:

packet-tracer input inside tcp <your pc address> 1025 8.8.8.8 80

That injects a dummy packet to the ASA's inside interface from your client's address using a random ephemeral tcp port as the source with a destination of an Internet address on port 80. (It doesn't matter whether or not anything at that address is listening on port 80 - we only care if the packet leaves the ASA.)

You can do the same thing from the ASDM GUI (Tools > Packet tracer)

If that command tells you at the end the packet is "ALLOWED", then your traffic is probably not reaching the ASA. To verify that, use the packet capture wizard (Wizards > Packet Capture Wizard) to look for the traffic incoming from your PC's source address.

I ran the packet-tracer and

KYLE NGUYEN — Thu, 08 Sep 2016 18:20:08 GMT

I ran the packet-tracer and the packet was "Allowed."

I'm pretty sure the traffic is not reaching the ASA for some reason.

I just don't understand why all other workstations are working fine, but it's blocking traffic to ASA on all new computers I add to the network. Why are some traffic reaching the ASA and some not? strange.

It could be any number of

Marvin Rhoads — Thu, 08 Sep 2016 18:29:32 GMT

It could be any number of things. Port security on your switch, an ACL in your core, a subnet mask mismatch somewhere, asymmetric routing etc.

Break it down step by step. See if you can reach the core switch from your new PC. Then the ASA. Don't just use ping, use something that requires a 3-way handshake like telnet

Ok I can telnet into the core

KYLE NGUYEN — Thu, 08 Sep 2016 18:47:05 GMT

Ok I can telnet into the core switch fine.

Telnet into ASA does not work. No connection.

We normally disable telnet on

Marvin Rhoads — Thu, 08 Sep 2016 18:50:17 GMT

We normally disable telnet on the ASA.

Make sure your source address / subnet is allowed in the ASA configuration (something like "ssh inside 0.0.0.0 0.0.0.0") and try ssh instead.

Don't think it's disabled,

KYLE NGUYEN — Thu, 08 Sep 2016 19:00:03 GMT

Don't think it's disabled, because I can telnet into the ASA from my computer fine.

It's just doesn't work from all new computers.

Check the packet capture I

Marvin Rhoads — Thu, 08 Sep 2016 19:31:33 GMT

Check the packet capture I noted earlier to see if the traffic is arriving at the AS inside interface.

Can you walk me through the

KYLE NGUYEN — Thu, 08 Sep 2016 19:44:44 GMT

Can you walk me through the Packet Capture Wizard?

Point of Ingress

Packet match criteria > do i choose specify packet parameters?

Then put in the source host and destination, protocol is IP?

Point of Egress

input same parameters from point of ingress?

Point of ingress is Inside

Marvin Rhoads — Thu, 08 Sep 2016 20:18:38 GMT

Point of ingress is Inside interface.

Match on your new PC source IP and netmask (255.255.255.255), protocol IP.

Egress leave it as any (0.0.0.0 0.0.0.0) since you don't care - you are just seeing if the packets arrive.

Here's what I got from the

KYLE NGUYEN — Thu, 08 Sep 2016 20:43:10 GMT

Here's what I got from the problematic ip address. So that means packets are hitting the ASA?

136 p

ackets captured