ASA 5505 losing outside interface

martynch1 — Mon, 11 Mar 2019 21:11:35 GMT

Hi all, I have a problem where my outside interface stops passing traffic and the only way to resolve the issue is to reload the ASA, the interface never is down it just stops passing traffic.

The inside interface never stops allowing traffic to pass as I can get to all my internal servers and shared drives.

The firmware is:

asa821-k8.bin

Running Config

: Saved

ASA Version 8.2(1)

hostname f1

domain-name somedomain.co.uk

enable password w1Y.GBKFyC5NqO3M encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 192.168.3.150 Martyn-Desktop description Martyn-Desktop

name 192.168.3.151 Chet-XBOX description Chet XBOX

name 192.168.3.152 CJ-PS3 description CJ-PS3

name 192.168.3.253 Switch description Switch

name 192.168.3.201 ACS description ACS

name 192.168.3.10 NCC-Laptop description NCC Laptop

name 192.168.3.12 IPPhone

interface Vlan1

 nameif inside

 security-level 100

 ip address 192.168.3.254 255.255.255.0

 ospf cost 10

interface Vlan4

 nameif outside

 security-level 0

 ip address dhcp setroute

 ospf cost 10

interface Ethernet0/0

 speed 100

 duplex full

interface Ethernet0/1

 speed 100

 duplex full

interface Ethernet0/2

 speed 100

 duplex full

interface Ethernet0/3

 speed 100

 duplex full

interface Ethernet0/4

 speed 100

 duplex full

interface Ethernet0/5

 speed 100

 duplex full

interface Ethernet0/6

 speed 100

 duplex half

interface Ethernet0/7

 switchport access vlan 4

 speed 100

banner exec *************************************************

banner exec *           All sessions are logged             *

banner exec *************************************************

banner motd *************************************************

banner motd *      THIS DEVICE IS ON A PRIVATE NETWORK      *

banner motd *************************************************

banner motd *  Unauthorised access or use of this equipment *

banner motd *       is prohibited and constitutes an        *

banner motd *  offence under the Computer Misuse Act 1990.  *

banner motd * If you are not authorised to use this system, *

banner motd *      terminate this session immediately.      *

banner motd *************************************************

banner motd *     This device should ONLY be accessed by    *

banner motd *            authorised staff.                  *

banner motd *************************************************

banner motd *************************************************

banner motd *          All Sessions are monitored           *

banner motd *             Tacacs+ is operational            *

banner motd *************************************************

banner asdm Welcome to

banner asdm All sessions are logged

boot system disk0:/asa821-k8.bin

ftp mode passive

clock timezone GMT/BST 0

clock summer-time GMT/BDT recurring last Sun Mar 1:00 last Sun Oct 2:00

dns server-group DefaultDNS

 domain-name somedomain.co.uk

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group network DM_INLINE_NETWORK_2

 network-object host NCC-Laptop

 network-object host IPPhone

object-group network DM_INLINE_NETWORK_4

 network-object 172.16.0.0 255.240.0.0

 network-object 192.168.0.0 255.255.0.0

access-list outside_access_in remark Torrent

access-list outside_access_in extended permit tcp any interface outside eq 45682

access-list outside_access_in remark Test Web

access-list outside_access_in extended permit tcp any interface outside eq www

access-list outside_access_in remark Test Telnet

access-list outside_access_in extended permit tcp any interface outside eq telnet

access-list outside_access_in remark Proxy

access-list outside_access_in extended permit tcp any interface outside eq 8080 inactive

access-list inside_nat0_outbound extended permit ip any 192.168.3.192 255.255.255.224 inactive

access-list inside_nat0_outbound extended permit ip object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_4

access-list outside_1_cryptomap extended permit ip object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_4

pager lines 24

logging enable

logging monitor emergencies

logging asdm informational

logging from-address asa@somedomain.co.uk

logging recipient-address martyn@ somedomain.co.uk level errors

logging class auth monitor emergencies

mtu inside 1500

mtu outside 1500

ip local pool test 192.168.3.200-192.168.3.210 mask 255.255.255.0

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-621.bin

asdm history enable

arp timeout 14400

nat-control

global (outside) 101 interface

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 101 0.0.0.0 0.0.0.0

static (inside,outside) tcp interface 45682 Martyn-Desktop 45682 netmask 255.255.255.255

static (inside,outside) udp interface ntp ACS ntp netmask 255.255.255.255

static (inside,outside) tcp interface www Martyn-Desktop www netmask 255.255.255.255

static (inside,outside) tcp interface telnet Switch telnet netmask 255.255.255.255

access-group outside_access_in in interface outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

aaa-server TACACS protocol tacacs+

aaa authentication enable console TACACS LOCAL

aaa authentication http console TACACS LOCAL

aaa authentication serial console TACACS LOCAL

aaa authentication ssh console TACACS LOCAL

aaa authentication telnet console TACACS LOCAL

http server enable

http 192.168.3.221 255.255.255.255 inside

http 192.168.3.102 255.255.255.255 inside

http 192.168.3.5 255.255.255.255 inside

http 192.168.3.3 255.255.255.255 inside

http Martyn-Desktop 255.255.255.255 inside

http 192.168.3.7 255.255.255.255 inside

http 194.61.208.10 255.255.255.255 inside

http 192.168.3.4 255.255.255.255 inside

http 192.168.3.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

auth-prompt prompt running tacacs

auth-prompt accept Accepted

auth-prompt reject Rejected

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 1 match address outside_1_cryptomap

crypto map outside_map 1 set peer 194.61.208.10

crypto map outside_map 1 set transform-set ESP-3DES-SHA

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map inside_map interface inside

crypto isakmp enable inside

crypto isakmp enable outside

crypto isakmp policy 10

 authentication pre-share

 encryption 3des

 hash sha

 group 2

 lifetime 86400

telnet 192.168.3.0 255.255.255.0 inside

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd dns 194.168.4.100 194.168.8.100 interface inside

threat-detection basic-threat

threat-detection scanning-threat shun duration 120

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200

ntp server ACS source inside prefer

webvpn

 enable inside

 enable outside

group-policy test internal

group-policy test attributes

 dns-server value 194.168.4.100 194.168.8.100

 vpn-tunnel-protocol IPSec l2tp-ipsec svc

username martyn password 0uANgU0vAu/KcErX encrypted privilege 15

tunnel-group test type remote-access

tunnel-group test general-attributes

 address-pool test

 authentication-server-group TACACS

 default-group-policy test

tunnel-group test ipsec-attributes

 pre-shared-key *

tunnel-group 194.61.208.10 type ipsec-l2l

tunnel-group 194.61.208.10 ipsec-attributes

 pre-shared-key *

class-map inspection_default

 match default-inspection-traffic

policy-map type inspect dns preset_dns_map

 parameters

  message-length maximum 512

policy-map global_policy

 class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

  inspect icmp

service-policy global_policy global

prompt hostname context

Cryptochecksum:18ed449922be5945dbabf244031823e9

: end

asdm image disk0:/asdm-621.bin

asdm location Chet-XBOX 255.255.255.255 inside

asdm location CJ-PS3 255.255.255.255 inside

asdm location ACS 255.255.255.255 inside

asdm location Switch 255.255.255.255 inside

asdm location NCC-Laptop 255.255.255.255 inside

asdm history enable

Does anybody know how I can start to diagnose and resolve this issue?

Thanks

topic ASA 5505 losing outside interface in Network Security

ASA 5505 losing outside interface

ASA 5505 losing outside interface

ASA 5505 losing outside interface

ASA 5505 losing outside interface

ASA 5505 losing outside interface