topic Re: Problems with Cisco ASA5510 in Network Security

Problems with Cisco ASA5510

miregistrocisco — Mon, 11 Mar 2019 13:36:29 GMT

Hi, I need some help configuring a Cisco ASA5510 firewall. I have connected the ethernet0/0 interface to a D-Link DSL-504T router whose ip address is 192.168.1.1. The ethernet0/1 interface is connected to a 3Com OfficeConnect Dual Speed Switch 5 switch that provides connection to several hosts. At first, I wrote down a basic configuration in order to permit all traffic coming from the inside network and use the ping command, but the firewall drops every incoming packet from the LAN. When I ping the router there is no reply and I also can't surf on internet, but pings to the ethernet0/0 interface are replied. This is the whole list of commands I used:

interface ethernet 0/0

nameif outside

security-level 0

ip address 192.168.1.2 255.255.0.0

no shutdown

exit

interface ethernet 0/1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

no shutdown

exit

route outside 0 0 192.168.1.1 1

dhcpd address 10.0.0.2-10.0.0.254 inside

dhcpd dns 80.58.0.33 62.37.228.20

dhcpd enable inside

access-list 100 extended permit icmp any any echo-reply

access-list 100 extended permit icmp any any time-exceed

access-list 100 extended permit icmp any any unreachable

access-group 100 in interface outside

nat (inside) 1 10.0.0.0 255.255.255.0

global (outside) 1 192.168.3.100-192.168.3.150

global (outside) 1 192.168.3.200

What's wrong with these settings? Did I forget any important detail? In case the configuration is wrong, could you please post here any other basical one?

PD: The ASA5510 works in routed firewall mode.

Re: Problems with Cisco ASA5510

andrew.prince — Wed, 27 Aug 2008 11:52:49 GMT

You are natting to a seperate IP subnet on the outside?

for testing cut and paste the below:-

global (outside) 2 interface

no nat (inside) 1 10.0.0.0 255.255.255.0

nat (inside) 2 10.0.0.0 255.255.255.0

re-test and post results.

Re: Problems with Cisco ASA5510

miregistrocisco — Thu, 28 Aug 2008 07:26:23 GMT

It works! but why am I natting to a separate subnet? 192.168.1.2 and 192.168.3.XXX addresses belong to the 192.168.0.0/16 subnet, don't they?

Re: Problems with Cisco ASA5510

andrew.prince — Thu, 28 Aug 2008 07:42:38 GMT

Yes they do - however it all depends on the next hop device. In your config you have:-

interface ethernet 0/0

nameif outside

security-level 0

ip address 192.168.1.2 255.255.0.0

route outside 0 0 192.168.1.1

global (outside) 1 192.168.3.100-192.168.3.150

OK - what is the mask on your next hop device facing the firewall?? /16 or /24 - does the router have arp enabled? Does the firewall have proxy arp enabled on the outside interface?

At the end - do you really need to NAT to a differnet IP subnet? Do you need 253 IP address for NAT?

Re: Problems with Cisco ASA5510

miregistrocisco — Thu, 28 Aug 2008 09:06:15 GMT

The router mask is /24, so that was the problem, I hadn't realised. I'll take care of mapped addresses in the future. Thanks a lot!

Re: Problems with Cisco ASA5510

andrew.prince — Thu, 28 Aug 2008 09:11:27 GMT

np - glad to help.