topic hi johnlloyd, in Network Security

Cisco ASA 5505 can ping gateway but can't ping internet

badingdong — Tue, 12 Mar 2019 04:41:17 GMT

Good day to all!

Sorry if I post this on the wrong group, I am having a bit of a problem on configuring an ASA 5505 firewall. And I scoured google but can't seem to find a specific link to my issues.

It is on a routed mode, have successfully configured inside and outside vlans. Hosts inside vlan can ping each other. Hosts on outside vlan can also ping each other. Problem is, when I am pinging 8.8.8.8, I received ????? Please see config below.

Any help greatly appreciated.

TIA!

##################

: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasan
enable password bD3fGYMFeJJTATOJ encrypted
passwd 2KF1w9ErdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description INSIDE
nameif inside
security-level 100
ip address 10.10.10.2 255.255.255.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
ip address 203.127.68.2 255.255.255.240
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list outside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 203.127.68.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
http authentication-certificate inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh 10.10.10.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
anyconnect-essentials
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:6b3e0ce99eda3d2563cf9f392f8001b7
: end

hi,you can move this thread

johnlloyd_13 — Thu, 28 Aug 2014 07:12:37 GMT

hi,

you can move this thread under Security > Firewalling forum to get better feedback.

could you ping 203.127.68.1?

try to connect a laptop and assign .2 and see if you can ping the ISP hop.

make sure you've got a route back to the 'inside' interface if you've got a router or another layer 3 device behind the ASA.

route inside 10.10.10.0 255.255.255.0 10.10.10.1

Can you execute a traceroute

Walter Astori — Thu, 28 Aug 2014 07:36:37 GMT

Can you execute a traceroute 8.8.8.8 source Vlan2 ?

Hi badingdong,- - - - - - - -

rizwanr74 — Thu, 28 Aug 2014 16:16:02 GMT

Hi badingdong,

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Remove these lines:

no nat (inside,outside) after-auto source dynamic any interface
no access-group outside_access_in in interface outside

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

If you have more inside subnets need access to internet, please make sure that you have a static route in place as shown below.

route inside 10.0.0.0 255.0.0.0 10.10.10.1

Also make sure that you have a correct DNS server is assigned on your internal hosts.

Thanks

Rizwan Rafeek

hi johnlloyd,

badingdong — Fri, 29 Aug 2014 01:56:04 GMT

hi johnlloyd, yes, i can ping the gateway 203.127.68.1 from outside interface. i can also ping all other public server that we have.

first successful hop was the

badingdong — Fri, 29 Aug 2014 01:57:32 GMT

first successful hop was the gateway, after that no more.

hi rizwanr74,

badingdong — Fri, 29 Aug 2014 02:08:09 GMT

hi rizwanr74, did what you told but still doesn't let me ping 8.8.8.8 Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: ????? Success rate is 0 percent (0/5) ciscoasan(config)#

hi,how about when you just

johnlloyd_13 — Fri, 29 Aug 2014 03:09:12 GMT

hi,

how about when you just connect a laptop and assign the .2 and ping out?

i suspect an ISP/routing issue.

your config looks fine.

Hi badingdong, I assume your

rizwanr74 — Fri, 29 Aug 2014 03:14:21 GMT

Hi badingdong,

I assume your inside is "interface Ethernet0/1" if so you assign it to vlan 1.

interface Ethernet0/1
switchport access vlan 1

Like I mentioned before you would not need two lines to access the internet.

Let me know please.

thanks

Rizwan Rafeek

Hi rizwan,

badingdong — Fri, 29 Aug 2014 03:14:22 GMT

Hi rizwan, I did took out those 2 lines you've mentioned. And also regarding vlan1, all of my ethernet ports are on vlan1 except for e0/0 which belongs to outside vlan2. Please see attached file for modified conf. Still can't think of the things I missed out. Still can't ping the internet using outside interface.

You are now missing your NAT

Marius Gunnerud — Fri, 29 Aug 2014 05:57:22 GMT

You are now missing your NAT statements. add the following:

object network obj_any
nat (inside,outside) dynamic interface

So you are able to ping the ISP (203.127.68.1) from the ASA, ? I would agree with John in that this seems a lot like an ISP problem rather than a problem with your ASA. I suggest contacting your ISP and have them check out you connection.

Please remember to select a correct answer and rate helpful posts

Hi marius,

badingdong — Fri, 29 Aug 2014 06:07:33 GMT

Hi marius, Thanks! I added the 2 lines you've mentioned. However, still I am not able to ping 8.8.8.8 from outside interface. ISP is out of the question because I am using pfsense with ip address on the same range as my outside ip on this cisco and same default route. Internet is fine with pfsense. Sorry for the inconvenience guys.. =(

I did not expect to solve the

Marius Gunnerud — Fri, 29 Aug 2014 06:29:39 GMT

I did not expect to solve the issue, but they are needed there so that the inside clients are able to reach the internet....once that is up and running.

If you have both CLI and ASDM open (open the realtime log viewer in ASDM) and ping 8.8.8.8 from the ASA do you see anything that might indicate that the ASA is dropping the return packets?

Another thing you could try is to do a packet capture between the inside and outside interfaces, and then ping 8.8.8.8 from a PC on the inside network. Do you see return traffick coming in the outside interface?

http://ipfield.net/2013/06/asa-packet-capture-using-cli-and-asdm-config-example/

Please remember to select a correct answer and rate helpful posts

Also, for the sake of trying

Marius Gunnerud — Fri, 29 Aug 2014 06:50:53 GMT

Also, for the sake of trying and if you are in a position to do so, save you ASA configuration and then restart the ASA.

If that does not work, and you see traffic leaving the outside interface but see no return traffic in the packet capture, and you see no log relating to the traffic being dropped in the the realtime log viewer, I would ask your ISP to do a clear ARP for your IP (though I would not suspect you to be able to ping your ISP if this was an ARP issue). You might also want to ask them to flap the interface that goes to your ASA on their side (shut, no shut).

When pinging from the box there should be nothing preventing the ASA from receiving a reply, or nothing configured on the ASA that will prevent the reply with your current configuration. Meaning you have a default route configured and interface configurations seem to be correct.

Please remember to select a correct answer and rate helpful posts

Hi Marius,

badingdong — Fri, 29 Aug 2014 06:56:37 GMT

Hi Marius, Thanks a lot on the pointers.. I was able to ping now 8.8.8.8 but what I did was I created a new vlan on port 0/1 of the asa and configured it identically to the outside vlan. Will try to reconfigure outside vlan to see what I missed.

hi johnlloyd,

badingdong — Fri, 29 Aug 2014 06:58:58 GMT

hi johnlloyd, i was able to ping 8.8.8.8 but on a newly configured vlan, identical to the outside vlan. Will now reconfigure outside vlan to see what i missed. Thanks! 😃

add ：access-list outside

weijun.duan — Fri, 29 Aug 2014 07:54:12 GMT

add ：access-list outside_access_in extended permit icmp any any

Interesting...what would be

Marius Gunnerud — Sat, 30 Aug 2014 06:31:13 GMT

Interesting...what would be interesting to see is if you moved VLAN 2 to Eth0/1...it could be that Eth0/0 is faulty.

If you are able to do so, set up Eth0/0 in the new outside VLAN and connect it to the ISP if it still doesn't work then that port is faulty

Please remember to select a correct answer and rate helpful posts

I'll check it later to see if

badingdong — Sun, 31 Aug 2014 23:46:36 GMT

I'll check it later to see if it is. Thanks!

Can you apply the following

anassor1121 — Sun, 29 Mar 2015 23:15:22 GMT

Can you apply the following and see if it will work.

policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error