topic ASA 5505 9.0(2) - No Internet Access in Network Security

ASA 5505 9.0(2) - No Internet Access

jwood1650 — Tue, 12 Mar 2019 01:53:39 GMT

I can't seem to get internet access with my current config, not sure what is going on with it.

I have my cable modem connected to my ASA @ FE0/0

My Wireless Router connected to ASA @ FE0/1

Wireless Network = 192.168.0.0/24

ASA Network = 10.0.10.0/28

Any help would be greatly apperciated

ASA Version 9.0(2)

hostname Firewall

enable password DQucN59Njn0OjpJL encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 10.0.10.1 255.255.255.240

interface Vlan2

nameif outside

security-level 0

ip address 24.234.1XXX.XXX 255.255.255.224

boot system disk0:/asa902-k8.bin

ftp mode passive

clock timezone PST -8

clock summer-time PDT recurring

dns domain-lookup inside

dns domain-lookup outside

dns server-group Cox_DNS

name-server 68.105.28.16

name-server 68.105.29.16

dns server-group Google_DNS

name-server 8.8.8.8

name-server 8.8.4.4

dns-group Cox_DNS

object network obj-10.0.10.0

subnet 10.0.10.0 255.255.255.240

object network obj_any

object network obj-10.0.10.1

host 10.0.10.1

pager lines 24

logging enable

logging asdm warnings

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp deny any outside

asdm image disk0:/asdm-712.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

object network obj-10.0.10.1

nat (inside,outside) static interface

router ospf 1

network 10.0.10.0 255.255.255.240 area 2

area 2

log-adj-changes

route outside 0.0.0.0 0.0.0.0 24.234.118.193 1

route inside 192.168.0.0 255.255.255.0 10.0.10.0 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 10.0.10.0 255.255.255.240 inside

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 192.168.0.0 255.255.255.0 inside

ssh 10.0.10.0 255.255.255.240 inside

ssh timeout 15

console timeout 0

dhcpd address 10.0.10.2-10.0.10.12 inside

dhcpd enable inside

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ntp authenticate

ntp server 64.250.229.100 source outside prefer

username woodjl1650 password slFkVmxAtfauhVaf encrypted privilege 15

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

class class-default

user-statistics accounting

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum client auto

message-length maximum 512

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 2

Cryptochecksum:055700069cddc2c8f71db6742ce50347

: end

ASA 5505 9.0(2) - No Internet Access

Christopher Bell — Thu, 06 Jun 2013 11:37:41 GMT

What's the 'outside' IP address of the interface of your wireless router? Are you connecting to the ASA or to the wireless router to test Internet connectivity? Assuming it's the wireless router (I don't see any dhcp settings on your ASA) then try giving yourself a static in the same subnet as the ASA 'inside' interface and test internet connectivity. Try pinging 8.8.8.8 if your home page doesn't load.

If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

Re: ASA 5505 9.0(2) - No Internet Access

jwood1650 — Thu, 06 Jun 2013 13:51:21 GMT

10.0.10.3

Can't ping they all fail from both the ASA and workstation behind wireless router.

Does the NAT and route statements look correct?

Sent from Cisco Technical Support iPhone App

Re: ASA 5505 9.0(2) - No Internet Access

Christopher Bell — Thu, 06 Jun 2013 14:08:32 GMT

The NAT and route statements appear to be part of the problem, but in order to toubleshoot we probably need to make sure ICMP echo-repy isn't being blocked. It looks like you are inspecting ICMP already so try this on the outside interface:

access-list outside_acl extended permit icmp any any echo-reply

access-list outside_acl extended permit icmp any any time-exceeded

access-group outside_acl in interface outside

Once you've done this, try connecting your workstation directly to the ASA, give it a static, ping the ASA inide interface. If that works, ping the outside interface. If that works, try pinging 8.8.8.8.

Some other possible issues:

* You don't have a NAT statement for anything with a 192.168.0.0/24 address

* What is the default route on your wireless router point to? Is it handing out dhcp?

I would encourage you to attach your workstation to the ASA and get that working first. Once you can access the Internet from the workstation, then work on why a client connected to the wireless router isn't working.

If this posts answers your question or is helpful, please consider rating it and/or marking as answered.

Re: ASA 5505 9.0(2) - No Internet Access

Julio Carvajal — Thu, 06 Jun 2013 14:16:02 GMT

Hello Jonathan,

The nat rule is incorrect:

Add the following

Remove the one you have

object network obj-10.0.10.1

no nat (inside,outside) static interface

nat (inside,outside) source dynamic any interface

no route inside 192.168.0.0 255.255.255.0 10.0.10.0 1

route 192.168.0.0 255.255.255.0 10.0.10.3

Make sure that from the ASA you can ping 10.0.10.3

If that works now go to the wireless router and make sure their default route it's something like this

0.0.0.0 0.0.0.0 10.0.10.1 (pointing to the ASA)

After you have that everything should work

Let us know how it goes,

Re: ASA 5505 9.0(2) - No Internet Access

Matt Lang — Thu, 06 Jun 2013 14:20:30 GMT

Jonathan,

I see several things that are wrong with your configuration. Try making these changes....

To correctly translate your internal hosts to the outside:

object network inside

subnet 10.0.10.0 255.255.255.240

nat (inside,outside) dynamic interface

object network wireless

subnet 192.168.0.0 255.255.255.0

nat (inside,outside) dynamic interface

You need to change your route to your wireless router. I can only imagine your wireless router is configured to not NAT the 192.168.0.0/24 addresses as they pass through that device, and that wireless router should have a 10.0.10.x address on its WAN interface.

no route inside 192.168.0.0 255.255.255.0 10.0.10.0 1

route inside 192.168.0.0 255.255.255.0 10.0.10.X

Matt

Re: ASA 5505 9.0(2) - No Internet Access

jwood1650 — Thu, 06 Jun 2013 14:46:22 GMT

That that helped...not only was my NAT statement wrong, Cox changed my IP addressed, so that was another issue as well. But I am up and running now. Do you have an guides on the 9.0 IOS?