topic ASA5005 problem: Host connected with it cannot go to internet in Network Security

ASA5005 problem: Host connected with it cannot go to internet

BluePho982 — Tue, 12 Mar 2019 08:12:07 GMT

The topology (see the jpeg attached) is as follows:

[HOST](192.168.2.2)------(192.168.2.1)[ASA 5505](192.168.1.100)------(192.168.1.1)[ROUTER]-------[INTERNET]

The host cannot go to internet, instead ASA can go.

Host can ping ASA gateway (192.168.2.1) but cannot ping 192.168.1.100:

The ASA 5505 has 8.2(1) version:

Here the config:

hostname ciscoasa
enable password ********************* encrypted
passwd *********************** encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.1.100 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8
name-server 8.8.8.4
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-621.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.2.2 255.255.255.255
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.2.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:ebd23464743e1895069680a7dfc12366
: end

Any idea?

Here are some tips:

Marvin Rhoads — Mon, 29 Aug 2016 20:18:28 GMT

Here are some tips:

For any sort of ping to work through an ASA, you need to "inspect icmp" in your "class inspection_default". Otherwise the icmp echo replies are not tied to any outbound icmp echo request and are thus dropped. (traceroute requires some other, additional, tweaks if you want that to work)

You will never be able to ping the ASA outside interface from an inside host. That does not work by design.

You should try an upstream host like the router or, better yet, use a typical application like http to an outside resource. That way you get a real tcp 3-way handshake and better validate an end-end application use case.

Note there must be some additional upstream NAT for Internet access since you are NATting your inside host o the ASA's outside interface address which is still an RFC 1918 private address.

Thanx for yor answer. It's

BluePho982 — Mon, 29 Aug 2016 21:11:35 GMT

Thanx for yor answer. It's the same... I tried to connect google from the host, but I did not succeed...

Did you validate upstream NAT

Marvin Rhoads — Mon, 29 Aug 2016 21:29:31 GMT

Did you validate upstream NAT?

i.e. ping tcp a website from the ASA itself to verify that the ASA outside interface is getting the necessary subsequent NAT from the upstream router.

asa-5512# ping tcp outside www.cisco.com 80 
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 104.117.1.155 port 80
from <redacted>, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 5/6/6 ms
asa-5512#

With my 5505 i can't launch

BluePho982 — Mon, 29 Aug 2016 23:49:11 GMT

With my 5505 i can't launch the "ping tcp outside" command
Instead i tried "ping outside www.cisco.com validate" and it was OK....

Resolved: incredibly I only

BluePho982 — Tue, 30 Aug 2016 00:09:42 GMT

Resolved: incredibly I only did a restart of the FW !!!!

Ha - sometimes that does it.

Marvin Rhoads — Tue, 30 Aug 2016 00:35:28 GMT

Ha - sometimes that does it.

Sorry about the 'tcp ping' suggestion confusion - that command was introduced later than your 8.2(1) software.