topic Re: ASA 5505 Internet Connection Problem in Network Security

ASA 5505 Internet Connection Problem

hugochengym — Mon, 11 Mar 2019 21:00:21 GMT

Dear Sirs,

Recently we found a tricky problem about ASA internet connection. We replaced a new firewall in our office but no internet connection for some colleagues. When the old one connected, no connection problem for all staff, basically we used Cisco 2960 switch in our network. Attached firewall configuration for your reference, what we missed in config you think?

Hugo

ASA 5505 Internet Connection Problem

varrao — Tue, 19 Jul 2011 02:07:03 GMT

Hi,

First of all, whenever your replace a device, you might need to reload all the upstream and downstream devices to clear the arp cache entries on them, they might still be holding onto the old arp entry.

Second;ly after going through your configuration zI could not see any default route for outside, the only one's atre for inside:

route inside 1.1.1.0 255.255.255.0 10.65.0.251 1

route inside 2.2.2.0 255.255.255.0 10.65.0.251 1

route inside 3.3.3.0 255.255.255.0 10.65.0.251 1

You might need a route to go to internet.

Let me know if this works out for you.

Thanks,

Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Tue, 19 Jul 2011 02:20:27 GMT

Varun

We used PPPoE for internet connect and script configured as below:

# interface Vlan2

# nameif outside

# security-level 0

# pppoe client vpdn group PCCW

# ip address pppoe setroute

For some staff can access internet but some cannot.This is a tricky point for me

Hugo

ASA 5505 Internet Connection Problem

varrao — Tue, 19 Jul 2011 04:53:07 GMT

Hi,

is it consistent, the users that are not able to access the internet, or is it intermittent issue for them??? Is it always the same inside users who are not able to access the internet?

Add the following command:

icmp permit any inisde

and check when there is no internet access for these users, are they able to ping the firewall inside interface.

Next step would be to collect captures and logs from the firewall and check whether firewall drops the requests from these internal users???

https://supportforums.cisco.com/docs/DOC-1222

Thanks,

-Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Tue, 19 Jul 2011 05:33:36 GMT

Varun

1. It is a consistent, it is not able access internet for same inside users

2. I submitted "icmp permit any inisde" and wait for firewall replacement and i will try to capture all log

Hugo

ASA 5505 Internet Connection Problem

varrao — Tue, 19 Jul 2011 06:01:54 GMT

Thats sounds good,

The idea is to collect as much info from the firewall, when the users are not able to connect.

-Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Wed, 20 Jul 2011 00:53:27 GMT

Varun

We tried to test the firewall this morning again, the same issue for some colleagues cannot access internet but not the same inside users this time (It should be the others inside staff). I am sorry that I have not enough time to do log capture this morning. Is there any configuration we missed in running config?

Re: ASA 5505 Internet Connection Problem

hugochengym — Wed, 20 Jul 2011 04:03:55 GMT

Varun

Do you think that related to the license issue?

ASA 5505 Internet Connection Problem

varrao — Wed, 20 Jul 2011 04:19:40 GMT

Absolutely....Bingo!!! that was going to be my next question to you, because the internal hosts not ale to access internet is always changing and random, which means that the first 10 hosts would only be able to access the internet and any 11th connection on the firewall would be dropped by firewall. You have a 10 user license, whicvh means only 10 concurrent hosts would be able to access internet. You might need to upgrade your firewall to unlimited or more users. Follow this licensing doc for more help:

http://www.cisco.com/en/US/customer/docs/security/asa/asa82/license/license82.html#wp190062

This hosuld definitely help you out. Check the license features for ASA 5505.

Thanks,

Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Wed, 20 Jul 2011 04:25:42 GMT

Varun

I am not able to access the link you provided

Hugo

Re: ASA 5505 Internet Connection Problem

varrao — Wed, 20 Jul 2011 04:29:21 GMT

Here's the PDF for it.

-Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Wed, 20 Jul 2011 04:51:13 GMT

Varun

Can you explain following message?

Hugo

ASA 5505 Internet Connection Problem

varrao — Wed, 20 Jul 2011 04:54:50 GMT

Its just that if you have a 10 users license then you can configure only 32 dhcp clients in your network, if ASA is acting as a dhcp server or relay.

-Varun

Re: ASA 5505 Internet Connection Problem

hugochengym — Wed, 20 Jul 2011 05:00:54 GMT

Varun

If we configure ASA firewall as a DHCP server, upto 32 DHCP hosts can access internet. If we use other DHCP server, it justs 10 hosts for internet connection. Is that what you meant?

ASA 5505 Internet Connection Problem

varrao — Wed, 20 Jul 2011 05:46:10 GMT

No, it means only a pool of 32 clients can be configured on the ASA, but still only 10 users would be able to access internet at a time. The license is for connections which are initiated from the inside clients to the outside internet. This can only be 210, whether you have DHCP configured or not.

Hope this helps,

Thanks,

Varun

ASA 5505 Internet Connection Problem

david.francisco. — Mon, 01 Jul 2013 19:00:20 GMT

Hi Varun:

I think you can help with an issue I have.

The problem is similar to this, I get the unlimited host license but some users in the office don´t have internet access.

I'm not familiar with the Cisco Asa, because of this I need help to fix this issue.

Thank you.