topic Re: ASA 5505 - Single netwrok to internet in Network Security

ASA 5505 - Single netwrok to internet

Hasrat Raja — Mon, 11 Mar 2019 23:46:17 GMT

Hi ,

I have configured an ASA 5505 to coonect a single internal network to internet, it is not working.

I have attached the config, please let me know what is missing.

Thank you for your help.

hasrat

ASA 5505 - Single netwrok to internet

Julio Carvajal — Fri, 24 Aug 2012 23:24:04 GMT

Hello Hasrat,

Basic configuration, should be workin.

Can you ping 10.1.1.2 from the ASA?

Regards,

Julio

ASA 5505 - Single netwrok to internet

Hasrat Raja — Sun, 26 Aug 2012 22:45:22 GMT

Hi Julio,

I can ping 10.1.1.2, this router is managed by another company, they are not able to access devices on 10.4.3.0 network.

Do I need to make any changes to my config ?

Thanks

hasrat

ASA 5505 - Single netwrok to internet

Julio Carvajal — Mon, 27 Aug 2012 04:45:41 GMT

Hello Hasrat,

Good so there is connectivity between your ASA and the default-gateway.

Right now they should not be able to access your internal network as you have not created any rule or nat translation to make it happen.

The thing here is why are you not able to access the internet.

I have you 2 different test to try:

1- ping 4.2.2.2 from the asa

2- packet-tracer input inside tcp 10.4.3.20 1025 4.2.2.2 80

Regards,

Julio

ASA 5505 - Single netwrok to internet

Hasrat Raja — Mon, 27 Aug 2012 16:58:27 GMT

Hi Julio,

Thank you for the reply, I have following nat statement:

object network Corporate_Internal

subnet 10.4.3.0 255.255.255.0 object network Corporate_Internal

nat (inside,outside) source dynamic Corporate_Internal interface

Do I need to add something to it ?

Thanks

hasrat

ASA 5505 - Single netwrok to internet

Julio Carvajal — Mon, 27 Aug 2012 19:48:53 GMT

Hello Hasrat,

Based on that you did not answer my question I would say you can ping 4.2.2.2

Regarding the nat query, the configuration is perfect.

Please do the packet tracer

packet-tracer input inside tcp 10.4.3.20 1025 4.2.2.2 80

Remember to rate all the helpful posts

Julio

ASA 5505 - Single netwrok to internet

Hasrat Raja — Tue, 28 Aug 2012 16:06:53 GMT

Hi Julio,

Sorry for the late response, I got the information that my device will not get internet access. My ASA is connecting to the VPN router for other company which they will use to access our internal devices, they are not able to get to them, I have pasted packet tracer output below:

ASA# packet-tracer input inside tcp 10.4.3.20 1025 4.2.2.2 80

Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside

Phase: 3
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source dynamic Corporate_Internal interface
Additional Information:
Dynamic translate 10.4.3.20/1025 to 10.1.1.1/1025

Phase: 6
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 41, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

ASA#
ASA#
ASA#
ASA# ping 4.2.2.2
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 4.2.2.2, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ASA#

thanks

hasrat

Re: ASA 5505 - Single netwrok to internet

Julio Carvajal — Tue, 28 Aug 2012 18:29:46 GMT

Hello Hasrat,

Okay, the other side of the tunnel will not make it as you do not have connectivity to the outside world.

Please check the connection from your ASA to the default gateway router .

Can you paste the configuration from the default gateway of the ASA?

Regards,

Julio

Remember to rate the helpful posts

ASA 5505 - Single netwrok to internet

Hasrat Raja — Tue, 28 Aug 2012 20:05:04 GMT

Hi Julio,

I don't have access to VPN router.

thanks

hasrat

ASA 5505 - Single netwrok to internet

Julio Carvajal — Tue, 28 Aug 2012 20:11:03 GMT

Hello Hasrat,

Can you ping the vpn router from the ASA?

Ping 10.1.1.2 1

ping 4.2.2.2

What do you get?

"Rate a post is also or even more importan than a thank you for the community users, remember to rate the helpful posts"

Julio