topic Re: No internet access with ASA 5506-x in Network Security

No internet access with ASA 5506-x

Maximus908 — Fri, 21 Feb 2020 16:51:38 GMT

Hello,

Can anybody help me please...?

I try to get through my new ASA with my pc, but I can't, after some days on the net to try to find a solution, I need your experience...:-)

I live in Belgium, thus excuse me for my poor technical English,

My problem is :

I connect the ASA behind a modem from my ISP, this modem is bridged in PPPOE.

Behind the ASA, I have 3 Cisco routers 2811, and 2 Cisco switchs, and in final my pc ( this is a topology for labs).

But I can't pass through the ASA with my pc, impossible to go out...

I can ping the IP address 192.168.1.1 (ASA Gi1/1) from my pc (10.2.99.1).

I think that I need access-list, but I don't know...

Here is the config :

LasVegasASA1# sh run
: Saved

:
: Serial Number: ********
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.4(1)
!
terminal width 350
hostname LasVegasASA1
enable password ******* encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
pppoe client vpdn group ISP1-PROXIMUS
ip address pppoe setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.252
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source dynamic any interface
!
object network obj_any
nat (any,outside) dynamic interface
router ospf 1
network 192.168.1.0 255.255.255.0 area 0
log-adj-changes
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group ISP1-PROXIMUS request dialout pppoe
vpdn group ISP1-PROXIMUS localname ********@PROXIMUS
vpdn group ISP1-PROXIMUS ppp authentication chap
vpdn username ********@PROXIMUS password ************ store-local
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:******************
: end

LasVegasASA1# sh int ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1/1 10*.***.***.79 YES manual up up
GigabitEthernet1/2 192.168.1.1 YES CONFIG up up
GigabitEthernet1/3 unassigned YES unset administratively down down
GigabitEthernet1/4 unassigned YES unset administratively down down
GigabitEthernet1/5 unassigned YES unset administratively down down
GigabitEthernet1/6 unassigned YES unset administratively down down
GigabitEthernet1/7 unassigned YES unset administratively down down
GigabitEthernet1/8 unassigned YES unset administratively down down
Internal-Control1/1 127.0.1.1 YES unset up up
Internal-Data1/1 unassigned YES unset up down
Internal-Data1/2 unassigned YES unset up up
Internal-Data1/3 unassigned YES unset up up
Management1/1 unassigned YES unset down down

LasVegasASA1# sh route

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 109.130.208.1 to network 0.0.0.0

S* 0.0.0.0 0.0.0.0 [1/0] via 10*.***.***.1, outside
O E2 10.2.3.0 255.255.255.0 [110/1] via 192.168.1.2, 04:21:03, inside
O E2 10.2.7.0 255.255.255.252 [110/1] via 192.168.1.2, 04:21:03, inside
O E2 10.2.7.4 255.255.255.252 [110/1] via 192.168.1.2, 04:21:03, inside
O E2 10.2.7.8 255.255.255.252 [110/1] via 192.168.1.2, 04:21:03, inside
O E2 10.2.99.0 255.255.255.0 [110/1] via 192.168.1.2, 04:21:03, inside
C 192.168.1.0 255.255.255.252 is directly connected, inside
L 192.168.1.1 255.255.255.255 is directly connected, inside
O E2 192.168.2.0 255.255.255.252 [110/1] via 192.168.1.2, 04:21:03, inside
O E2 192.168.3.0 255.255.255.252 [110/1] via 192.168.1.2, 04:21:03, inside

Thank you in advance for your answer.

Marc

Re: No internet access with ASA 5506-x

venkat_n7 — Mon, 25 Feb 2019 18:49:49 GMT

access-list ALLOW_ALL extended permit ip any any

access-group ALLOW_ALL in int outside

Re: No internet access with ASA 5506-x

Maximus908 — Mon, 25 Feb 2019 19:54:58 GMT

Thank you,

I've added your two commands, but it doesn't work...

Re: No internet access with ASA 5506-x

venkat_n7 — Mon, 25 Feb 2019 20:25:30 GMT

add default route statement.

and redistribute default and connected routes to ospf. and can you do packet trace from inside and to outside.

Re: No internet access with ASA 5506-x

Richard Burts — Mon, 25 Feb 2019 20:53:21 GMT

Marc

Use these commands to update your config

policy-map global_policy
class inspection_default
inspect icmp

There is no need for the access list and access group on your outside interface. And they open your ASA up to all outside traffic. I suggest that you remove them.

There is no need to change how your OSPF is operating and no indication that your issue is related to routing. After all your PC is successful in routing to the ASA and the ASA is successful in routing to your PC (that is how your ping was successful). I believe that the fundamental problem is the security posture of the ASA which needs to inspect the icmp traffic to be able to forward it between ASA interfaces.

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Mon, 25 Feb 2019 22:13:41 GMT

Thank you for this advice Richard, but no access...:-(

You can find screens of ping from ASA to pc and to external DNS, and ipconfig(from pc), then ping from pc to gateway, ping to ASA Gi1/1, all is ok, but nothing from pc to external dns...

I've remove the commands for access-list, and add yours

policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp

I've no ideas..

Re: No internet access with ASA 5506-x

Maximus908 — Mon, 25 Feb 2019 22:14:51 GMT

I've tried yours commands, but nothing works....
Thank you

Re: No internet access with ASA 5506-x

venkat_n7 — Mon, 25 Feb 2019 22:55:17 GMT

i see you can ping from asa to opendns ip address. So,

can you check packet trace and see where packet is dropping

command:

" packet-trace input inside icmp 10.2.99.1 1 1 8.8.8.8 detailed " may be this should help.

Apologies for above comments if they were incorrect.

Re: No internet access with ASA 5506-x

Richard Burts — Mon, 25 Feb 2019 23:12:36 GMT

Can you also add inspection for icmp error

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Tue, 26 Feb 2019 09:23:23 GMT

Hello Venkat,

Here is the result of the your command :

LasVegasASA1# packet-tracer input inside icmp 10.2.99.1 1 1 8.8.8.8 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 109.130.208.1 using egress ifc outside

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source dynamic any interface
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffdd4d6140, priority=6, domain=nat, deny=false
hits=6, user_data=0x7fffddd24f40, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=outside

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffdd400b20, priority=0, domain=nat-per-session, deny=true
hits=1973, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffddb831c0, priority=0, domain=inspect-ip-options, deny=true
hits=28, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-xlate-failed) NAT failed

Do you have a solution ?

Marc

Re: No internet access with ASA 5506-x

Maximus908 — Tue, 26 Feb 2019 09:24:53 GMT

Hello Richard,

I'm novice on ASA, can you give the command to add for icmp inspection error please ?

Thank you.

Marc

Re: No internet access with ASA 5506-x

Richard Burts — Tue, 26 Feb 2019 13:23:00 GMT

policy-map global_policy
class inspection_default
inspect icmp error

HTH

Rick

Re: No internet access with ASA 5506-x

Richard Burts — Tue, 26 Feb 2019 13:41:48 GMT

Marc

In reviewing the config I notice that there are 2 nat statements

nat (inside,outside) source dynamic any interface
!
object network obj_any
nat (any,outside) dynamic interface

I am not sure why and suggest removing the second one.

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Tue, 26 Feb 2019 14:42:46 GMT

Richard,

I put your inspection command in the configuration, and I've remove the second nat command...

Here is the config now :

LasVegasASA1# sh run
: Saved

:
: Serial Number: ******
: Hardware: ASA5506, 4096 MB RAM, CPU Atom C2000 series 1250 MHz, 1 CPU (4 cores)
:
ASA Version 9.4(1)
!
terminal width 350
hostname LasVegasASA1
enable password ******* encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
pppoe client vpdn group ISP1-PROXIMUS
ip address pppoe setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.252
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
pager lines 24
logging console debugging
logging asdm informational
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (inside,outside) source dynamic any interface
router ospf 1
router-id 13.13.13.13
network 192.168.1.0 255.255.255.0 area 0
log-adj-changes
redistribute connected metric 1 subnets
default-information originate always
!
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
vpdn group ISP1-PROXIMUS request dialout pppoe
vpdn group ISP1-PROXIMUS localname ******@PROXIMUS
vpdn group ISP1-PROXIMUS ppp authentication chap
vpdn username ******@PROXIMUS password ****** store-local
dhcpd dns 208.67.220.220 208.67.222.222
dhcpd lease 3000
dhcpd ping_timeout 30
dhcpd auto_config outside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
inspect icmp error
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:0f87b8c305a1f1ced72659987b0a6582
: end

LasVegasASA1# packet-tracer input inside icmp 10.2.99.1 1 1 8.8.8.8 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 109.130.208.1 using egress ifc outside

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside,outside) source dynamic any interface
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffddd28ee0, priority=6, domain=nat, deny=false
hits=1, user_data=0x7fffddb93a70, cs_id=0x0, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=outside

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffdd400b20, priority=0, domain=nat-per-session, deny=true
hits=305, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fffddb831b0, priority=0, domain=inspect-ip-options, deny=true
hits=4, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=inside, output_ifc=any

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (nat-xlate-failed) NAT failed

LasVegasASA1# sh route

S* 0.0.0.0 0.0.0.0 [1/0] via 109.130.208.1, outside
O E2 10.2.3.0 255.255.255.0 [110/1] via 192.168.1.2, 00:21:28, inside
O E2 10.2.7.0 255.255.255.252 [110/1] via 192.168.1.2, 00:21:28, inside
O E2 10.2.7.4 255.255.255.252 [110/1] via 192.168.1.2, 00:21:28, inside
O E2 10.2.7.8 255.255.255.252 [110/1] via 192.168.1.2, 00:21:28, inside
O E2 10.2.99.0 255.255.255.0 [110/1] via 192.168.1.2, 00:21:28, inside
C 192.168.1.0 255.255.255.252 is directly connected, inside
L 192.168.1.1 255.255.255.255 is directly connected, inside
O E2 192.168.2.0 255.255.255.252 [110/1] via 192.168.1.2, 00:21:28, inside
O E2 192.168.3.0 255.255.255.252 [110/1] via 192.168.1.2, 00:21:28, inside

LasVegasASA1# sh int ip brief
Interface IP-Address OK? Method Status Protocol
GigabitEthernet1/1 8*.***.***.202 YES CONFIG up up
GigabitEthernet1/2 192.168.1.1 YES CONFIG up up
GigabitEthernet1/3 unassigned YES unset administratively down down
GigabitEthernet1/4 unassigned YES unset administratively down down
GigabitEthernet1/5 unassigned YES unset administratively down down
GigabitEthernet1/6 unassigned YES unset administratively down down
GigabitEthernet1/7 unassigned YES unset administratively down down
GigabitEthernet1/8 unassigned YES unset administratively down down
Internal-Control1/1 127.0.1.1 YES unset up up
Internal-Data1/1 unassigned YES unset up down
Internal-Data1/2 unassigned YES unset up up
Internal-Data1/3 unassigned YES unset up up
Management1/1 unassigned YES unset down down

LasVegasASA1# ping 10.2.99.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.2.99.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/20 ms
LasVegasASA1# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/20 ms

Re: No internet access with ASA 5506-x

Richard Burts — Tue, 26 Feb 2019 14:57:09 GMT

Thank you for the update. I am sorry that the changes I suggested did not change the behavior. I am puzzled why the nat appears to not be working. You have enabled logging to the console. Can you establish a console session, try to access Internet from the PC, and look for any log messages that might help us understand the issue? Or perhaps enable logging to the logging buffer so you can use show log rather than needing a console session.

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Tue, 26 Feb 2019 15:37:52 GMT

No problem, thank you for your time...:-)

Here is the messages of the console after ping from pc 10.2.99.1 to ASA 192.168.1.1, and from pc to 8.8.8.8

LasVegasASA1(config)# logging enable
LasVegasASA1(config)# %ASA-5-111008: User 'enable_15' executed the 'logging enable' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'logging enable'
%ASA-7-609001: Built local-host inside:10.2.99.1
%ASA-6-302020: Built inbound ICMP connection for faddr 10.2.99.1/1 gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-6-302021: Teardown ICMP connection for faddr 10.2.99.1/1 gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-7-609002: Teardown local-host inside:10.2.99.1 duration 0:00:00
%ASA-7-710005: TCP request discarded from 90.31.71.75/64274 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 95.157.198.108/61735 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.91.170/47787 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 90.31.71.75/60985 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 102.97.116.170/60999 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 102.97.116.170/62775 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.27/10806 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.138.98.46/16321 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 62.197.65.233/55781 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 62.197.65.233/58987 to outside:109.129.13.224/51034
%ASA-7-609001: Built local-host inside:10.2.99.1
%ASA-6-302020: Built inbound ICMP connection for faddr 10.2.99.1/1 gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-6-302021: Teardown ICMP connection for faddr 10.2.99.1/1 gaddr 192.168.1.1/0 laddr 192.168.1.1/0
%ASA-7-609002: Teardown local-host inside:10.2.99.1 duration 0:00:00
%ASA-7-710005: UDP request discarded from 154.125.58.232/27497 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.91.170/47787 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.233.19/29505 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 78.116.231.228/50807 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 78.116.231.228/50859 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 160.154.145.92/16589 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.91.170/47787 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 160.154.145.92/39631 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.77/60881 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: TCP request discarded from 62.4.132.138/8893 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.131/28903 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 102.97.116.170/60999 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.138.98.46/16321 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 102.97.116.170/62775 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.91.170/47787 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.72.168.219/14393 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 207.180.210.81/23006 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 207.180.210.81/22989 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.233.19/29505 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 207.180.210.81/23006 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 95.157.198.108/61735 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 207.180.210.81/23006 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 62.197.65.233/55781 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 212.52.154.44/64728 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 62.197.65.233/58987 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: UDP request discarded from 178.22.170.41/50830 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.91.170/47787 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 102.97.116.170/60999 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 92.169.136.72/42303 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 92.169.136.72/59307 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 102.97.116.170/62775 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 212.52.154.44/64728 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.82/64411 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.138.98.46/16321 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.242.231/9857 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.107.207.183/21212 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9227 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.203/24713 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 217.15.239.107/49075 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 217.15.239.107/53441 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.41/50830 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.233.19/29505 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: TCP request discarded from 92.169.136.72/59307 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 89.105.158.246/49021 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.53/24979 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.97/58805 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 92.169.136.72/42303 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.163.78.73/6253 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.163.78.73/1911 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.203.226.36/49241 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.82/64411 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.242.231/9857 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9227 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 217.15.239.107/53441 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 217.15.239.107/49075 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.175/19602 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.203/24713 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 213.136.79.27/51471 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 212.52.154.44/64728 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.53/24979 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.163.78.73/1911 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.163.78.73/6253 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: UDP request discarded from 178.22.170.175/19602 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.41/50830 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 207.180.210.81/12023 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 62.197.65.233/55884 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 62.197.65.233/58987 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 92.169.136.72/59307 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 213.136.79.27/12281 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 92.169.136.72/42303 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.82/64411 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9227 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.181.98.228/58339 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.181.98.228/50508 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.242.231/9857 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.98.46/64930 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 217.15.239.107/53441 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 217.15.239.107/49075 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.203/24713 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 62.197.65.233/55884 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.233.19/29826 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 213.136.79.27/12304 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 62.197.65.233/58987 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: TCP request discarded from 91.163.78.73/1911 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 188.110.123.190/6889 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.53/24979 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.98.46/64930 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.163.78.73/6253 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.181.98.228/50508 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.181.98.228/58339 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 129.0.76.231/45085 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 129.0.76.231/53790 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.175/19602 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 169.159.26.240/1181 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.233.19/29826 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9350 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 62.197.65.233/55884 to outside:109.129.13.224/51034
%ASA-7-710006: IGMP request discarded from 10.1.1.1 to outside:224.0.0.251
%ASA-6-110002: Failed to locate egress interface for IGMP from outside:10.1.1.1/0 to 239.255.255.250/0
%ASA-7-710005: UDP request discarded from 62.197.65.233/58987 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 129.0.76.231/45085 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 129.0.76.231/53790 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 5.189.188.23/46969 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 149.154.225.231/38977 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.181.98.228/50508 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.72.168.219/14630 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.181.98.228/58339 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.138.98.46/64930 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.86.175.164/27555 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9350 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.233.19/29826 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: UDP request discarded from 176.163.7.49/24874 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.86.175.164/52752 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 5.189.188.23/57923 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.68.5.113/32534 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 54.38.178.26/1026 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.86.175.164/27555 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 105.111.60.21/1024 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 169.159.26.240/1181 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.86.175.164/52752 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.89/40166 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.68.5.113/32534 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 176.163.7.49/24874 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
%ASA-7-710005: TCP request discarded from 105.111.60.21/51573 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 54.38.178.26/1026 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 41.213.189.7/9350 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.97/58805 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.57/37650 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.68.5.119/37488 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 41.213.189.7/58229 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 154.68.5.119/40110 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034
n%ASA-7-710005: UDP request discarded from 105.111.60.21/1024 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 154.68.5.113/44040 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.20/54268 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 94.109.163.163/17871 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 213.136.79.205/7191 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 94.109.163.163/17871 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 94.109.163.163/17871 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 94.109.163.163/17871 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 105.111.60.21/51573 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034
n%ASA-7-710005: UDP request discarded from 91.86.175.164/27555 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.15/7202 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.68.5.119/37488 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.97/58805 to outside:109.129.13.224/51034
%ASA-7-710006: EIGRP request discarded from 192.168.1.2 to inside:224.0.0.10
o%ASA-7-710005: UDP request discarded from 154.68.5.119/40110 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 91.86.175.164/52752 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 154.68.5.113/32535 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 154.68.5.113/44040 to outside:109.129.13.224/51034
l%ASA-7-710005: UDP request discarded from 178.22.170.20/54268 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 176.163.7.49/24874 to outside:109.129.13.224/51034
o%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 91.182.8.23/47532 to outside:109.129.13.224/51034
%ASA-7-710005: TCP request discarded from 149.154.242.231/11009 to outside:109.129.13.224/51034

LasVegasASA1(config)# no lo enable %ASA-7-710005: TCP request discarded from 176.163.7.49/54846 to outside:109.129.13.224/51034
%ASA-7-710005: UDP request discarded from 178.22.170.15/7202 to outside:109.129.13.224/51034

%ASA-5-111008: User 'enable_15' executed the 'no logging enable' command.
%ASA-5-111010: User 'enable_15', running 'CLI' from IP 0.0.0.0, executed 'no logging enable'

Re: No internet access with ASA 5506-x

Richard Burts — Tue, 26 Feb 2019 17:10:48 GMT

Thank you for the log messages (and there are certainly a lot of them). I do see log messages relating to pc pinging the ASA interface. But I do not see any messages relating to pc pinging 8.8.8.8.

Would you post the output of show nat detail

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Tue, 26 Feb 2019 19:02:46 GMT

Indeed, no 8.8.8.8 ???

Here is sh nat :

LasVegasASA1(config)# sh nat detail
Manual NAT Policies (Section 1)
1 (inside) to (outside) source dynamic any interface
translate_hits = 0, untranslate_hits = 0
Source - Origin: 0.0.0.0/0, Translated: 109.129.13.224/32

Re: No internet access with ASA 5506-x

Richard Burts — Tue, 26 Feb 2019 19:42:20 GMT

Thank you for the output. It is interesting that the hit count is 0. I am wondering if the ping attempt to outside is getting to the ASA. It looks like the pc is several hops away from the ASA. Is it possible that one of those devices has some security policy that does not allow the ping to external addresses? Or is it possible that one of those devices does not have a default route?

It might be interesting to compare the results of tracert 192.168.1.1 and tracert 8.8.8.8

HTH

Rick

Re: No internet access with ASA 5506-x

Maximus908 — Wed, 27 Feb 2019 07:47:01 GMT

I will review all my configurations one by one, and I will come back to you if I have found one or more errors, thank you

Have a nice day...:-)

Marc