topic ASA 8.2(4) Having problem with basic setup in Network Security

ASA 8.2(4) Having problem with basic setup

Joshua Engels — Mon, 11 Mar 2019 20:40:58 GMT

I know my ASA has internet connectivity. From my ASA I can ping out to 4.2.2.2. When I put my PC behind the firewall, for some reason I cannot browse the internet. I'm not sure what the issue is but the config is very basic and it is attached. My first thought was that I do not have NAT setup correctly but I'm not 100% sure on that. See attached config.

Re: ASA 8.2(4) Having problem with basic setup

varrao — Wed, 01 Jun 2011 14:19:57 GMT

Hi Joshua,

Are you able to ping the firewall fro the PC?? are you able to ping the next hop from the PC?? Have you tried packet-tracer from firewall?/

packet-tracer input inside tcp ho 23456 ho 2.2.2.2 80 detailed.

can you provide the output for it??

try taking acptures as well on the firewall to check if the packets are reaching the firewall or not.

packet-captures:

https://supportforums.cisco.com/docs/DOC-1222

The config looks fine.

Thanks,

Varun

Re: ASA 8.2(4) Having problem with basic setup

Joshua Engels — Wed, 01 Jun 2011 14:36:49 GMT

Found the issue. It is with my Management interface. As soon as I disabled the management interface everything started working. Any ideas why this is?

Re: ASA 8.2(4) Having problem with basic setup

varrao — Wed, 01 Jun 2011 14:42:07 GMT

Hi Joshua,

On which interface had you connected the laptop???

Varun

Re: ASA 8.2(4) Having problem with basic setup

Joshua Engels — Wed, 01 Jun 2011 15:06:29 GMT

So here is how I am setup. Diagram attached.

I route through the core switch and then through the ASA to the internet.

To manage the ASA I setup the managment interface on the same vlan I am on so that I can connect directly to it. It seems that this may be confusing the ASA's return path or something.

Re: ASA 8.2(4) Having problem with basic setup

Kureli Sankar — Wed, 01 Jun 2011 15:34:08 GMT

Joshua,

This is causing asymmetry. The management network cannot live behind the inside.

You cannot use mgmt ip address and go to the internet via the inside interface. When the response traffic comes back, it will try to take the mgmt interface and fail.

You need to take the same path going and coming.

Best option to solve this is to use a route-map on the switch.

access-list 120 per ip 192.168.99.0 0.0.0.255 any

route-map mgmt per 10

match ip address 120

set ip next-hop 192.168.99.100

-KS