topic cannot connect to internet in Network Security

cannot connect to internet

davidwu2007 — Mon, 11 Mar 2019 19:58:51 GMT

I set up an ASA 5505 at home through PPPOE connection. The ASA seems to obtain an IP address correctly.

and I can ping a public ip address using the outside nic, but not the inside nic. I saw the error message

when I ping: No route to ff0213 from fe801bc2b1288cd5bc1. As a result, I cannot connect to the Internet.

Help!

Re: cannot connect to internet

allanc16 — Tue, 01 Mar 2011 06:50:25 GMT

Ok so inside hosts cannot access the Internet - can you post your configuration so we can take a look?

Re: cannot connect to internet

IAN WHITMORE — Tue, 01 Mar 2011 08:23:21 GMT

Sounds like you are missing the default route...something like:

route outside 0.0.0.0 0.0.0.0 x.x.x.x 1

But as Allan said, if you can post the config we can take a look.

Regards,

Ian

Re: cannot connect to internet

davidwu2007 — Tue, 01 Mar 2011 16:05:13 GMT

Thank you for your reply. Attached is the running configuration file.

Re: cannot connect to internet

davidwu2007 — Tue, 01 Mar 2011 16:06:31 GMT

Thanks for reply. configuration file has attached

Re: cannot connect to internet

tj.mitchell — Tue, 01 Mar 2011 16:48:14 GMT

Who is assigning IP Addresses to the hosts? What is your DNS set to for the hosts? Can you ping out to the internet, just not browse?

Re: cannot connect to internet

davidwu2007 — Tue, 01 Mar 2011 17:04:18 GMT

I can add the following command lines, but makes no differences

dhcpd address 10.40.1.11-10.40.1.33 inside

dhcpd dns 64.83.1.10 64.83.0.10

dhcpd enable inside

Thanks for your input!!

Re: cannot connect to internet

tj.mitchell — Tue, 01 Mar 2011 17:16:03 GMT

you shouldn't have to do this but, just for fun add these lines:

access-list inside-out permit ip any any

access-group inside-out in interface inside

Re: cannot connect to internet

davidwu2007 — Tue, 01 Mar 2011 17:20:18 GMT

OK, thanks.

I will try it later. BTW, the host is obtaining the ip address through PPPOE connection.

Re: cannot connect to internet

allanc16 — Wed, 02 Mar 2011 00:36:12 GMT

can you do this?:

Your inside network is as follows: 10.40.1.0 255.255.255.0

can you configure a host with an ip under this range and set up its default gateway to be 10.40.1.10 (ASA). Once this is done try to ping the firewall inside IP address -> 10.40.1.10

If you are succesfull then ping a host on the internet like 4.2.2.2 --> make sure you add a ACL on the outside interface to permit the echo reply back.

If succesfull you should be able to browse.

Also, a good idea is to enable the debug for ICMP: debug icmp trace

Also enable logging to see any important logs:

If you are logged in via telnet:

logging monitor 7

logg on
term mon

term no mon -> to disable this

If you are logged in via console:

Logg console 7

logg on

no logg on -> to disable it

To disbale the debug icmp trace debug:

und all

Let us know!

Re: cannot connect to internet

jubetz — Wed, 02 Mar 2011 02:13:57 GMT

What does a packet tracer say?

packet-tracer input inside tcp 10.40.1.5 12345 198.133.219.25 80 detail

Best Regards,

-jb

Re: cannot connect to internet

davidwu2007 — Wed, 02 Mar 2011 15:08:36 GMT

I would like to thank all of you giving me good suggestions on this problem.

It was Windows Vista problem. Windows Network Diagnostics tool automatically

repaired Internet connection problem by resetting DNS commmunication.

Sincerely,

David Wu