Can't Reach Outside interface

aoun.ameur1 — Tue, 12 Mar 2019 07:00:30 GMT

Hi all,

I have install this lab with gns3 :

I tried to reach gig1 on the ASA1, which is the outside interface in ASA1 from C1, but without succeed.

The configuration in ASA1 is as below :

ciscoasa# sh running-config
: Saved
:
ASA Version 8.4(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
 shutdown
 no nameif
 security-level 100
 no ip address
!
interface GigabitEthernet1
 nameif inside
 security-level 0
 ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet2
 nameif outside
 security-level 0
 ip address 100.100.100.1 255.255.255.0
!
interface GigabitEthernet3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet5
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object network internal-lan
 subnet 192.168.1.0 255.255.255.0
access-list outside_access_in extended permit icmp any any echo-reply log disable
access-list outside_access_in_1 extended permit icmp any any echo-reply
access-list ICMPACL extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-645.bin
no asdm history enable
arp timeout 14400
!
object network internal-lan
 nat (any,outside) dynamic interface
access-group ICMPACL in interface inside
access-group outside_access_in_1 in interface outside
route outside 0.0.0.0 0.0.0.0 100.100.100.2 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username test password P4ttSyrm33SV8TYp encrypted
!
class-map ICPCM
class-map ICMPCM
 match access-list ICMPACL
!
!
policy-map ICMPPM
 class ICMPCM
 inspect icmp
!
service-policy ICMPPM global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
 no active
 destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
 destination address email callhome@cisco.com
 destination transport-method http
 subscribe-to-alert-group diagnostic
 subscribe-to-alert-group environment
 subscribe-to-alert-group inventory periodic monthly
 subscribe-to-alert-group configuration periodic monthly
 subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:1c751d8ccc22679d9d6be7b764ec56d2
: end

Is there any suggestion please ?

What do you mean when you say

Andre Neethling — Tue, 08 Dec 2015 08:20:16 GMT

What do you mean when you say reach? Are you trying to ping? Access via ssh or ASDM?

The ASA behaves differently to a router. I don't hink you can access the outside interface from the LAN on the inside interface of ther ASA.

Can you access the router off the outside interface? That should be the test you should do for connectivity through the ASA.

topic Can't Reach Outside interface in Network Security

Can't Reach Outside interface

What do you mean when you say