topic Re: ASA 5510 with Cisco 2811 Router Behind it - Not forwarding t in Network Security

ASA 5510 with Cisco 2811 Router Behind it - Not forwarding traffic

metuckness — Tue, 12 Mar 2019 03:45:50 GMT

Hi all,

Some might know that I have been dealing with an issue where I cannot seem to get forwarded packets to reach their destinations behind an ASA 5510 that has a Cisco 2811 connected directly behind it.

Some examples that work.

I can SSH into the ASA.

I can SSH to the Cisco Routers behind the ASA.

I cannot reach items beind the Cisco Routers.

My Configuration is this (I am sure I included a bunch of info I didn't need to, but I am hoping it'll help!😞

I have a static Ip assigned to my Ouside Interface Ethernet 0/1

It has an IP address of 199.195.xxx.xxx

I am trying to learn how to shape network traffic (this is all new to me) via the ASA and the Routers to specific devices.

The Inside Interface on the ASA is 10.10.1.1 255.255.255.252

The Outside Interface on the 2811 is 10.10.1.2 255.255.255.252

I can ping the router from the ASA. I can SSH through the ASA to the router.

BUT I CANNOT ACCESS DEVICES BEHIND THE ROUTER.

So, I wanted to BAM that statement above because I just don't kjnow where the issue is. Is the issue on the router or the ASA, my guess is, the router, but I just don't know.

Here are my configs, helpfully someone can help.

ASA errors on the ASDM when I try and hit resources; specifically a web device behind the ASA and the 2811. It's Ip address 192.168.1.5 it's listening on port 80.Static IP, not assigned via DHCP.

Feb 14 2014

19:38:56

98.22.121.x

41164

192.168.1.5

Built inbound TCP connection 1922859 for Outside:98.22.121.x/41164 (98.22.121.x/41164) to Inside:192.168.1.5/80 (199.195.168.x/8080)

Feb 14 2014

19:38:56

10.10.1.2

98.22.121.x

41164

Deny TCP (no connection) from 10.10.1.2/80 to 98.22.121.x/41164 flags SYN ACK on interface Inside

ASA5510# sh nat

Auto NAT Policies (Section 2)

1 (DMZ) to (Outside) source static ROUTER-2821 interface service tcp ssh 2222

translate_hits = 1, untranslate_hits = 18

2 (Inside) to (Outside) source static ROUTER-2811 interface service tcp ssh 222

translate_hits = 0, untranslate_hits = 13

3 (VOIP) to (Outside) source static ROUTER-3745 interface service tcp ssh 2223

translate_hits = 0, untranslate_hits = 3

4 (Inside) to (Outside) source static RDP-DC1 interface service tcp 3389 3389

translate_hits = 0, untranslate_hits = 236

5 (Inside) to (Outside) source static WEBCAM-01 interface service tcp www 8080

translate_hits = 0, untranslate_hits = 162

Manual NAT Policies (Section 3)

1 (any) to (Outside) source dynamic PAT-SOURCE interface

translate_hits = 1056862, untranslate_hits = 83506

ASA5510# show access-list

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 4096)

alert-interval 300

access-list USERS; 1 elements; name hash: 0x50681c1e

access-list USERS line 1 standard permit 10.10.1.0 255.255.255.0 (hitcnt=0) 0xdd6ba495

access-list Outside_access_in; 5 elements; name hash: 0xe796c137

access-list Outside_access_in line 1 extended permit tcp host 98.22.121.x object ROUTER-2811 eq ssh (hitcnt=37) 0x5a53778d

access-list Outside_access_in line 1 extended permit tcp host 98.22.121.x host 10.10.1.2 eq ssh (hitcnt=37) 0x5a53778d

access-list Outside_access_in line 2 extended permit tcp host 98.22.121.x object ROUTER-2821 eq ssh (hitcnt=8) 0x9f32bc21

access-list Outside_access_in line 2 extended permit tcp host 98.22.121.x host 10.10.0.2 eq ssh (hitcnt=8) 0x9f32bc21

access-list Outside_access_in line 3 extended permit tcp host 98.22.121.x interface Outside eq https (hitcnt=0) 0x385488b2

access-list Outside_access_in line 4 extended permit tcp host 98.22.121.x object WEBCAM-01 eq www (hitcnt=60) 0xe66674ec

access-list Outside_access_in line 4 extended permit tcp host 98.22.121.x host 192.168.1.5 eq www (hitcnt=60) 0xe66674ec

access-list Outside_access_in line 5 extended permit tcp host 98.22.121.x object RDP-DC1 eq 3389 (hitcnt=3) 0x02f13f4e

access-list Outside_access_in line 5 extended permit tcp host 98.22.121.x host 192.168.1.2 eq 3389 (hitcnt=3) 0x02f13f4e

access-list dmz-access-vlan1; 1 elements; name hash: 0xc3450860

access-list dmz-access-vlan1 line 1 extended permit ip 128.162.1.0 255.255.255.0 any (hitcnt=0) 0x429fedf1

access-list dmz-access; 3 elements; name hash: 0xf53f5801

access-list dmz-access line 1 remark Permit all traffic to DC1

access-list dmz-access line 2 extended permit ip 128.162.1.0 255.255.255.0 host 192.168.1.2 (hitcnt=0) 0xd2dced0a

access-list dmz-access line 3 remark Permit only DNS traffic to DNS server

access-list dmz-access line 4 extended permit udp 128.162.1.0 255.255.255.0 host 192.168.1.2 eq domain (hitcnt=0) 0xbb21093e

access-list dmz-access line 5 remark Permit ICMP to all devices in DC

access-list dmz-access line 6 extended permit icmp 128.162.1.0 255.255.255.0 192.168.1.0 255.255.255.0 (hitcnt=0) 0x71269ef7

CISCO-2811#show access-lists

Standard IP access list 1

10 permit any (1581021 matches)

CISCO-2811#show translate

CISCO-2811#show route

CISCO-2811#show route-map

CISCO-2811#show host

CISCO-2811#show hosts

Default domain is maladomini.int

Name/address lookup uses domain service

Name servers are 192.168.1.2, 199.195.168.4, 205.171.2.65, 205.171.3.65, 8.8.8.8

Codes: UN - unknown, EX - expired, OK - OK, ?? - revalidate

temp - temporary, perm - permanent

NA - Not Applicable None - Not defined

Host Port Flags Age Type Address(es)

api.mixpanel.com None (temp, OK) 2 IP 198.23.64.21

198.23.64.22

198.23.64.18

198.23.64.19

198.23.64.20

ASA5510:

ASA5510# sh run all

: Saved

ASA Version 9.1(4)

command-alias exec h help

command-alias exec lo logout

command-alias exec p ping

command-alias exec s show

terminal width 80

hostname ASA5510

domain-name maladomini.int

enable password x encrypted

no fips enable

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

xlate per-session permit tcp any4 any4

xlate per-session permit tcp any4 any6

xlate per-session permit tcp any6 any4

xlate per-session permit tcp any6 any6

xlate per-session permit udp any4 any4 eq domain

xlate per-session permit udp any4 any6 eq domain

xlate per-session permit udp any6 any4 eq domain

xlate per-session permit udp any6 any6 eq domain

passwd x encrypted

names

dns-guard

lacp system-priority 32768

interface Ethernet0/0

description LAN Interface

speed auto

duplex auto

no flowcontrol send on

nameif Inside

security-level 100

ip address 10.10.1.1 255.255.255.252

delay 10

interface Ethernet0/1

description WAN Interface

speed auto

duplex auto

no flowcontrol send on

nameif Outside

security-level 0

ip address 199.195.168.xxx 255.255.255.240

delay 10

interface Ethernet0/2

description DMZ

speed auto

duplex auto

no flowcontrol send on

nameif DMZ

security-level 100

ip address 10.10.0.1 255.255.255.252

delay 10

interface Ethernet0/3

description VOIP

speed auto

duplex auto

no flowcontrol send on

nameif VOIP

security-level 100

ip address 10.10.2.1 255.255.255.252

delay 10

interface Management0/0

speed auto

duplex auto

management-only

shutdown

nameif management

security-level 0

no ip address

delay 10

regex _default_gator "Gator"

regex _default_firethru-tunnel_2 "[/\\]cgi[-]bin[/\\]proxy"

regex _default_shoutcast-tunneling-protocol "1"

regex _default_http-tunnel "[/\\]HT_PortLog.aspx"

regex _default_x-kazaa-network "[\r\n\t ]+[xX]-[kK][aA][zZ][aA][aA]-[nN][eE][tT][wW][oO][rR][kK]"

regex _default_msn-messenger "[Aa][Pp][Pp][Ll][Ii][Cc][Aa][Tt][Ii][Oo][Nn][/\\][Xx][-][Mm][Ss][Nn][-][Mm][Ee][Ss][Ss][Ee][Nn][Gg][Ee][Rr]"

regex _default_GoToMyPC-tunnel_2 "[/\\]erc[/\\]Poll"

regex _default_gnu-http-tunnel_uri "[/\\]index[.]html"

regex _default_aim-messenger "[Hh][Tt][Tt][Pp][.][Pp][Rr][Oo][Xx][Yy][.][Ii][Cc][Qq][.][Cc][Oo][Mm]"

regex _default_gnu-http-tunnel_arg "crap"

regex _default_icy-metadata "[\r\n\t ]+[iI][cC][yY]-[mM][eE][tT][aA][dD][aA][tT][aA]"

regex _default_GoToMyPC-tunnel "machinekey"

regex _default_windows-media-player-tunnel "NSPlayer"

regex _default_yahoo-messenger "YMSG"

regex _default_httport-tunnel "photo[.]exectech[-]va[.]com"

regex _default_firethru-tunnel_1 "firethru[.]com"

checkheaps check-interval 60

checkheaps validate-checksum 60

boot system disk0:/asa914-k8.bin

ftp mode passive

clock timezone UTC 0

dns domain-lookup Outside

dns server-group DefaultDNS

name-server 199.195.168.4

name-server 205.171.2.65

name-server 205.171.3.65

domain-name maladomini.int

same-security-traffic permit inter-interface

object service ah pre-defined

service ah