topic Re: ASA not able to ping internet in Network Security

ASA not able to ping internet

Waterbird — Fri, 25 Oct 2019 13:22:08 GMT

Hello. I'm attempting to configure the ASA in the GNS3 topology show below. I was able to set up the ASA as a DHCP server to configure the computer, so the inside network appears to be configured correctly. However, I'm not able to ping google.com or 8.8.8.8 from the ASA.

The NAT node in the diagram is supposed to provide DHCP services. I configured the ASA's interface gig 0/0 to receive it's IP addressing from DHCP using this command. It worked, and received an address from the NAT node's pool.

ip address dhcp

I'm assuming, then, that I'm missing some additional configurations on the ASA to make the ASA act as a DCHP client for other things like DNS and the default gateway, which I assume will be sent also by the NAT node once the ASA is configured correctly. I've reviewed the ASA DHCP documentation but only found information there on DHCP server configuration, but nothing on DHCP client configuration for the ASA itself. I also reviewed the GNS3 NAT node documentation and found nothing about what the default gateway address is, or anything that would help me manually configure this.

I've posted the commands I've so far entered in the ASA. Please advise as to what I'm missing here. Thanks!

Re: ASA not able to ping internet

kubn2 — Fri, 25 Oct 2019 14:47:32 GMT

Hi,

To make dhcp on ASA to provide default gateway you need use command: dhcpd option 3 ip gateway_ip

On client side there is nothing needed to be configured just switch option on PC to download IP configuration from DHCP server and it should found ASA automatically.

Re: ASA not able to ping internet

Rob Ingram — Fri, 25 Oct 2019 14:50:28 GMT

Hi,
Does the ASA itself have a default route? Configure "ip address dhcp setroute", in order for the outside interface to learn the default route via DHCP.

HTH

Re: ASA not able to ping internet

Waterbird — Fri, 25 Oct 2019 15:22:43 GMT

I applied the "ip address dhcp setroute" command. It receives an IP address. The ASA can can ping 8.8.8.8 but not google.com. It gives the error invalid hostname.

Re: ASA not able to ping internet

Waterbird — Tue, 29 Oct 2019 05:51:22 GMT

The question is partially solved, but not completely solved, at least for my topology. Using the configs recommended above, my ASA can ping the IP address, but not the DNS name, of websites.

Re: ASA not able to ping internet

Rob Ingram — Fri, 25 Oct 2019 15:34:02 GMT

You will need to enable DNS domain lookup on the outside interface and define the name server, then you should be able to ping a host name from the ASA.

dns domain-lookup outside
dns name-server 8.8.8.8