topic ASA 5505 unable to Ping in Network Security

ASA 5505 unable to Ping

woodjl1650 — Mon, 11 Mar 2019 21:22:33 GMT

I just tried to configure my ASA but unable to ping. My setup is as follows:

Cable Modem (DHCP from IPS)---> ASA (192.168.1.1)--->Belking Router (192.168.5.1)--->Switch (192.168.5.14)--->

Can you please look through my config and tell me what I did wrong?

Thanks,

ASA Version 8.2(3)

hostname WoodHomeASA-1

domain-name lv.cox.net

enable password DQucN59Njn0OjpJL encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

shutdown

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

banner login ** W A R N I N G **

banner login Unauthorized access prohibited. All access is

banner login monitored, and trespassers shall be prosecuted

banner login to the fullest extent of the law.

banner login ** W A R N I N G **

boot system disk0:/asa823-k8.bin

boot config disk0:/asa823.bin

ftp mode passive

dns server-group DefaultDNS

domain-name lv.cox.net

object-group icmp-type ICMP-INBOUND

description Permit necessary inbound ICMP traffic

icmp-object echo-reply

icmp-object unreachable

icmp-object time-exceeded

access-list INBOUND extended permit icmp any any object-group ICMP-INBOUND

access-list INBOUND extended permit tcp any any eq www

pager lines 24

logging console notifications

logging buffered warnings

logging asdm notifications

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

asdm image disk0:/asdm-633.bin

no asdm history enable

arp timeout 14400

nat-control

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

access-group INBOUND in interface outside

route inside 192.168.5.0 255.255.255.0 192.168.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:00:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 inside

ssh 192.168.1.0 255.255.255.255 inside

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

dhcpd dns 8.8.8.8 8.8.4.4 interface inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl encryption des-sha1

webvpn

enable outside

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map type inspect dns prsent_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

service-policy global_policy global

prompt hostname context

Cryptochecksum:658d8baf4bb5df65563b0cc499a9f287

: end

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 08:47:27 GMT

Where are you trying to ping to and from?

Please also add the following:

policy-map global_policy

class inspection_default

inspect icmp

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 08:48:42 GMT

Trying to ping the router, I didn't have internet connection when I tried after loading the config.

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 08:54:41 GMT

Trying to ping the router from the ASA? or ping the router from your host inside? What ip address of the router are you trying to ping?

I don't see a 192.168.1.x ip address assign to the router, and the "route inside" command on the ASA should be pointing to the router interface in 192.168.1.x subnet.

How many routed interface does your router have? are they all routed port or some are switch ports on the router?

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 09:00:33 GMT

Trying to ping from the ASA to the router. The routers IP addess is 192.168.5.1, and 4 switches built in. I don't believe I can modify the router much. I have the router connected to port 1 on the ASA.

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 09:05:44 GMT

ok, didn't know that the router has switched ports.

In that case, you would need to configure the router with ip address of 192.168.1.x, instead of 192.168.5.1.

you can remove from the ASA:

no route inside 192.168.5.0 255.255.255.0 192.168.1.1

All other hosts internally should also be in 192.168.1.x subnet.

"clear arp" on the ASA after making the changes. You should be able to ping after that.

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 09:24:22 GMT

I can ping, but no internet access. My cable modem is plugged into port 0/0 and the router in plugged into 0/1.

Router !P: 192.168.5.1 ASA IP 192.168.5.99

Current running Config:

ASA Version 8.2(3)

hostname WoodHomeASA-1

domain-name lv.cox.net

enable password DQucN59Njn0OjpJL encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

shutdown

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 192.168.5.99 255.255.255.0

interface Vlan2

nameif outside

security-level 100

ip address dhcp setroute

banner login ** W A R N I N G **

banner login Unauthorized access prohibited. All access is

banner login monitored, and trespassers shall be prosecuted

banner login to the fullest extent of the law.

banner login ** W A R N I N G **

banner login

ftp mode passive

dns server-group DefaultDNS

domain-name lv.cox.net

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.5.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 192.168.5.0 255.255.255.255 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

service-policy global_policy global

prompt hostname context

Cryptochecksum:79d729f48498a703ba44115626b86882

: end

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 09:33:36 GMT

Are you getting an ip address on the ASA outside interface connected to the cable modem?

Can you ping the internet from the ASA? Try to ping 4.2.2.2 and see if you get any reply.

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 09:35:37 GMT

I get a no route to host error.

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 09:38:10 GMT

And also, the outside interface should have security-level of 0, not 100.

Can you check if the outside interface is getting an ip address?

"show int" will show you if the outside interface gets any ip address.

Also, "show route" on the ASA.

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 09:45:49 GMT

Ethernet Port 0/0 where the internet is plugged into says IP Address Unassinged, and the same for Port 0/1. This is what the vlan's are set as. 0/0 is Vlan2 and 0/0 is Vlan1

interface Vlan1

nameif inside

security-level 100

ip address 192.168.5.99 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

ASA 5505 unable to Ping

Jennifer Halim — Fri, 09 Sep 2011 09:55:23 GMT

if there is no ip address assigned on ethernet0/0 which is your outside interface, you wont' have any internet connectivity.

Is your cable modem assigning ip address to the ASA eth0/0 interface?

Try the following re-enable the dhcp setroute command on ASA vlan 2:

interface Vlan2

no ip address dhcp setroute

ip address dhcp setroute

Try to reload the cable modem too and see if you are getting any ip address.

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 10:07:38 GMT

getting an ip address, but still says no route to host.

ASA 5505 unable to Ping

cadet alain — Fri, 09 Sep 2011 10:43:15 GMT

Hi,

which gear says that the ASA or router? have you got a default route on router pointing to ASA ?

how is the routing table on ASA? sh route will tell you if you've got a default route

Regards.

Alain.

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 17:48:04 GMT

I try to ping from the ASA to the internet, but nothing. I can ping the inside address just fine. I can't configure the router much since it is a belkin, and the "show route" on the ASA is:

192.168.1.0 255.255.255.0 is directly connected, inside

I just seems that the ASA doesn't see the internet when it is connected. Is there some config that I messed up or over looked?

Again here is the running config:

ASA Version 8.2(3)

hostname WoodHomeASA-1

domain-name lv.cox.net

enable password DQucN59Njn0OjpJL encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

shutdown

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.99 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

ftp mode passive

dns server-group DefaultDNS

domain-name lv.cox.net

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any outside

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 192.168.1.0 255.255.255.255 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

service-policy global_policy global

prompt hostname context

Cryptochecksum:c7d6b178cee5317035ba8b6dc2af1c2d

: end

ASA 5505 unable to Ping

Kureli Sankar — Fri, 09 Sep 2011 19:07:24 GMT

Pls. get the output of

sh ip

sh route

ping the GW on the outside and see if that responds.

-KS

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 19:29:55 GMT

System IP Addresses:

Interface Name IP address Subnet mask

Method

Vlan1 inside 192.168.1.99 255.255.255.0

CONFIG

Vlan2 outside unassigned unassigned

DHCP

Current IP Addresses:

Interface Name IP address Subnet mask

Method

Vlan1 inside 192.168.1.99 255.255.255.0

CONFIG

Vlan2 outside unassigned unassigned

DHCP

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP

D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area

N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2

E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP

i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area

* - candidate default, U - per-user static route, o - ODR

P - periodic downloaded static route

Gateway of last resort is not set

C 192.168.1.0 255.255.255.0 is directly connected, inside

WoodHomeASA-1# ping 68.108.10.1

Type escape sequence to abort.

Sending 5, 100-byte ICMP Echos to 68.108.10.1, timeout is 2 seconds:

No route to host 68.108.10.1

Success rate is 0 percent (0/1)

ASA 5505 unable to Ping

Kureli Sankar — Fri, 09 Sep 2011 19:39:38 GMT

The outside hasn't even got an IP address yet. You can't go no where from this ASA.

Are you supposed to have static IP or dynamic DHCP address do you know? What device is the ASA's outside itnerface connected to?

Reach out to the ISP and ask them about IP address for your outside.

-KS

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 19:40:52 GMT

DHCP IP Address and the ASA is connected to the cable modem via ethernet port 0/0

ASA 5505 unable to Ping

woodjl1650 — Fri, 09 Sep 2011 19:59:25 GMT

I just realized I might have an issue now. I finally go internet to the ASA, but since I have Belkin router, I don't think the WAN port on it will work coming off the ASA since they are on the same network. It doesn't "pick up" the internet signal when I plug it into the switch port or the WAN port. Is there something I can do on the ASA, since there no not much I can configure with the Belkin Router? Am I stuck now?