Stuck at work

Shawn.gaston1 — Tue, 12 Mar 2019 05:35:15 GMT

Guys I have a Cisco asa 5505. It has been working perfectly fine until round 5pm yesterday evening when i got the call the internet was down at this office. i logged in to start to troubleshooting the issue and looked. nothing supposed changed on the firewall I looked and didnt see anything either. so i called the isp no issues. even verified by plugging a laptop directly into the external and testing works fine. I'm stumped as i can test the ping from the asa no issues inbound or out bound. attached the config if any way could tell em anything that looks like would stop it. again i apologize for my ignorance as trying to learn as much on asa's as possible.

!
interface Vlan1
nameif inside
security-level 100
ip address 10.30.5.2 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 72.64.148.113 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.10.0.0_24
subnet 10.10.0.0 255.255.255.0
object network 10.10.11.0_24
subnet 10.10.11.0 255.255.255.0
object network 10.10.12.0_24
subnet 10.10.12.0 255.255.255.0
object network 10.10.13.0_24
subnet 10.10.13.0 255.255.255.0
object network 10.10.96.0_24
subnet 10.10.96.0 255.255.255.0
object network 10.2.0.0_24
subnet 10.2.0.0 255.255.255.0
object network 10.3.0.0_24
subnet 10.3.0.0 255.255.255.0
object network 10.30.1.0
subnet 10.30.1.0 255.255.255.0
object network 10.10.51.0
subnet 10.10.51.0 255.255.255.0
object network 10.5.0.0
subnet 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_1
network-object 10.10.51.0 255.255.255.0
network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
network-object 10.10.51.0 255.255.255.0
network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_3
network-object 10.10.82.0 255.255.255.0
network-object 10.10.85.0 255.255.255.0
object-group network DM_INLINE_NETWORK_4
network-object 10.10.51.0 255.255.255.0
network-object 10.5.0.0 255.255.255.0
object-group network Oak_New
network-object object 10.10.11.0_24
network-object object 10.10.12.0_24
network-object object 10.10.13.0_24
network-object object 10.10.96.0_24
network-object object 10.2.0.0_24
network-object object 10.3.0.0_24
object-group network DM_INLINE_NETWORK_5
network-object 10.10.51.0 255.255.255.0
network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_6
network-object 10.5.0.0 255.255.255.0
network-object object 10.10.51.0
object-group network DM_INLINE_NETWORK_7
network-object object 10.10.51.0
network-object object 10.5.0.0
access-list outside_access_in extended permit icmp any any time-exceeded
access-list outside_access_in extended permit icmp any any unreachable
access-list outside_access_in extended permit icmp any any echo-reply
access-list outside_1_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 10.10.0.0 255.255.255.0
access-list outside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_3
access-list outside_3_cryptomap extended permit ip object-group DM_INLINE_NETWORK_4 object-group Oak_New
access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group Oak_New
access-list outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_6 object 10.30.1.0
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static DM_INLINE_NETWORK_7 DM_INLINE_NETWORK_7 destination static 10.30.1.0 10.30.1.0
nat (inside,outside) source static DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 destination static Oak_New Oak_New
nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_10.10.0.0_24 NETWORK_OBJ_10.10.0.0_24
nat (inside,outside) source static DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3
!
object network obj_any
nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 72.64.148.1 1
route inside 10.5.0.0 255.255.255.0 10.30.5.1 1
route inside 10.10.51.0 255.255.255.0 10.30.5.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
http 50.199.101.249 255.255.255.255 outside
http 10.10.51.0 255.255.255.0 inside
http 10.30.5.0 255.255.255.0 inside
http 66.194.205.54 255.255.255.255 outside
no snmp-server location
no snmp-server contact
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer 66.194.205.54
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 2 match address outside_2_cryptomap
crypto map outside_map 2 set pfs group1
crypto map outside_map 2 set peer 50.199.101.249
crypto map outside_map 2 set transform-set ESP-3DES-SHA
crypto map outside_map 3 match address outside_3_cryptomap
crypto map outside_map 3 set peer 50.192.34.253
crypto map outside_map 3 set transform-set ESP-AES-128-SHA
crypto map outside_map 4 match address outside_cryptomap
crypto map outside_map 4 set peer 50.192.34.253
crypto map outside_map 4 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 5 match address outside_cryptomap_1
crypto map outside_map 5 set peer 50.79.225.66
crypto map outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 30
authentication pre-share
encryption aes
hash sha
group 5
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
vpn-tunnel-protocol IPSec
username dkraut password 6iNmW1JnA8NEZk4S encrypted privilege 15
tunnel-group 66.194.205.54 type ipsec-l2l
tunnel-group 66.194.205.54 ipsec-attributes
pre-shared-key *****
tunnel-group 50.199.101.249 type ipsec-l2l
tunnel-group 50.199.101.249 ipsec-attributes
pre-shared-key *****
tunnel-group Oak type ipsec-l2l
tunnel-group Oak ipsec-attributes
pre-shared-key *****
tunnel-group 50.192.34.253 type ipsec-l2l
tunnel-group 50.192.34.253 general-attributes
default-group-policy GroupPolicy1
tunnel-group 50.192.34.253 ipsec-attributes
pre-shared-key *****
tunnel-group 50.79.225.66 type ipsec-l2l
tunnel-group 50.79.225.66 general-attributes
default-group-policy GroupPolicy1
tunnel-group 50.79.225.66 ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect pptp
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:08ba45188992f77e9f9105aa46772839
: end

Hi, Does everyone on the LAN

Jouni Forss — Wed, 04 Mar 2015 08:35:46 GMT

Hi,

Does everyone on the LAN have the problem? Can anyone connect to the Internet?

Your post seems to indicate that the ASA has normal connectivity through the WAN link to the Internet.

I guess next I would take one example host from the LAN for which connection dont work and step by step go through the situation.

For example

Check where the host tries to connect. I would imagine its always using a name that the host queries from the DNS server. If you have a local server acting as DNS server I would confirm that its able to provide the host with the IP address to its DNS queries. On a computer running Windows you could use the Start Menu -> Run -> nslookup and then write the destination DNS name to which the host tries to connect to determine if the host gets a DNS reply.
If the DNS portion is fine then I would confirm that the connectivity from the host to the firewall is fine. There are naturally multiple ways. You could ping the interface IP address of the ASA behind which the host is. If there is no reply then look through ASDM logs if you can see anything of the ICMP there.
You can naturally just try to connect with the host to the Internet and at the same time monitor the connection attempts through ASDM from this single host.
If you can't even see connection attempts on the firewall then I would turn my eye on the LAN networks devices. It seems you have an internal router since the ASA has routes towards some internal IP address. Make sure all the devices on the LAN are ok and have connectivity. Make sure that no changes have been made to them.

- Jouni

Jouni I finally got it fixed.

Shawn.gaston1 — Sun, 08 Mar 2015 14:26:47 GMT

Jouni I finally got it fixed. it was a nat issue. but why it changed I don't know. one thing is can you explain to me why I had to put the any any inside outside nat rule below any static nats for this to work? I don't really understand that part but as soon as I did that all came up fine. thanks for all your help again.

topic Stuck at work in Network Security

Stuck at work

Hi, Does everyone on the LAN

Jouni I finally got it fixed.