topic ASA 5510 - Can't access internet in Network Security

ASA 5510 - Can't access internet

dcsdoor1975 — Fri, 21 Feb 2020 12:43:26 GMT

I'm installing a new ASA 5510. I tried to configure a simple setup and get that working before I deal with DMZ and VPN. I can't even get our internal subnet to access the internet on the outside interface. My internal subnet is 192.168.0.0/24 and my outside IP is 63.93.81.98 and gw is 63.93.81.97. I'm not sure what I'm missing here. Here is my config:

Result of the command: "show running-config"

: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
domain-name doorcontrolsusa.com
enable password aqGwzrart3V.q/x2 encrypted
passwd 2KFQnbNIdI.2KYOu encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 63.93.81.98 255.255.255.248
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.0.252 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
dns domain-lookup outside
dns domain-lookup inside
dns server-group DefaultDNS
name-server 192.168.0.7
domain-name doorcontrolsusa.com
dns server-group Outside
name-server 198.6.100.38
name-server 198.6.1.5
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list inside_access_in extended permit ip 192.168.0.0 255.255.255.0 any
pager lines 24
logging enable
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.0.0 255.255.255.0
access-group inside_access_in in interface inside control-plane
route outside 0.0.0.0 0.0.0.0 63.93.81.97 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:a487a8689e1d63da2c6a4c8c50eda685
: end

I'm using ASDM and a little CLI as I'm very new to this. Any help is much appreciated.

Thanks,

Keith Nations

ASA 5510 - Can't access internet

Jennifer Halim — Thu, 30 Aug 2012 13:21:01 GMT

The following command:

access-group inside_access_in in interface inside control-plane

should be:

access-group inside_access_in in interface inside

Also, are you able to ping the internet, try to ping 4.2.2.2, or even try to ping 63.93.81.97, from a PC and see if you have any replies.

Perhaps you have no DNS resolution?

I also assume that your PC default gateway is 192.168.0.252, and your PC is configured with ip address of 192.168.0.x and subnet mask of 255.255.255.0 ?

ASA 5510 - Can't access internet

dcsdoor1975 — Fri, 31 Aug 2012 13:44:08 GMT

Without changing anything, it seems to be working now. My ISP could have been having issues. I'm still testing to make sure it doesn't drop. Then I'll dive into setting up DMZ and VPN. Thanks for your help.

ASA 5510 - Can't access internet

Jennifer Halim — Fri, 31 Aug 2012 13:56:56 GMT

Good to hear all is good now. All the best with the rest of the config.

ASA 5510 - Can't access internet

santiago.jem — Mon, 03 Sep 2012 13:02:51 GMT

Hi Jennifer,

Sorry for crashing in this thread. I have a similar problem, actually.

I have just configured a site-to-site VPN between ASA5510-ASA5520 running ASA 8.4(3).

Site-to-site VPN is working and humming along. Thing is, I can't browse the internet.

I CAN however ping 4.2.2.2 but havent tried any other public IP address for that matter.

I have already configured nat with the following command:

object network inside-net

nat (inside,outside) dynamic interface

Still, I cant browse the internet.

Hope to hear from you soon.

Thank you.

Regards,

Jemel

ASA 5510 - Can't access internet

Jennifer Halim — Mon, 03 Sep 2012 13:16:38 GMT

no problem, Jemel.

If you can ping 4.2.2.2 that means you have internet connectivity.

Most probably your DNS resolution is not working, ie: try to see if cisco.com resolves to any ip address. If not, then check the DNS setting.

ASA 5510 - Can't access internet

santiago.jem — Mon, 03 Sep 2012 22:16:14 GMT

Hi Jennifer,

Yes I think that solved the issue for me. Thank you. What I did was replace the DNS with th public DNS server of 4.2.2.2.

Our PCs get their IP Addresses from the ASA, IP Addresses are renewed, including DNS Servers.

Could it be that the issue is with the ISP DNS Server?

Regards,

Jemel

ASA 5510 - Can't access internet

Jennifer Halim — Tue, 04 Sep 2012 02:09:49 GMT

Definitely sounds like an issue with the ISP DNS server. Otherwise, if you use 4.2.2.2, it won't work too if there is issue with the ASA.

I would check with your ISP for the DNS server, because if you use 4.2.2.2, depending on where you are, the DNS resolution might take longer time than using your ISP DNS server because it should be local/closer to where you are.

All the best.

Re: ASA 5510 - Can't access internet

beatinger — Sat, 03 Aug 2019 06:44:15 GMT

I am also having an issue accessing the Internet from workstations/server behind my Cisco ASA5540 firewall. I have worked on this for many hours, with no luck. I have been using Cisco PIX firewalls for years, and am trying very hard to get over on this ASA5540 firewall. I honestly do not understand what the issue is. I can ping out to the Internet from the firewall, no problem, both a IPs and at DNS names. I just cannot get out to the Internet from any server or workstation. The following is my configuration, and after that, a "show version" output. Please let me know what you think might be wrong here. Thank you very much!

ciscoasa5540(config)# show config
: Saved
: Written by enable_15 at 18:29:44.131 UTC Fri Aug 2 2019
!
ASA Version 7.2(2)
!
hostname ciscoasa5540
domain-name edenhosting.net
enable password Vkz0vtCccFeMll8t encrypted
names
name 10.1.252.245 NS1 description Primary DNS Server (91)
name 10.1.252.219 Sendmail description OLD Mail Server (92)
name 10.1.252.247 ExchangeServer description Exchange Server 2016 (94)
name 10.1.252.249 WebServerIIS80 description Windows Server 2012 (93)
name 10.1.252.190 DRAC-DNS description DRAC for DNS Server (87)
name 10.1.252.191 DRAC-WebServer description DRAC for Web Server (92)
name 10.1.252.246 NAS description Synology NAS (86)
name 10.1.252.250 WebServerIIS10 description Windows Server 2019 (88)
name 10.1.252.192 DRAC-VirtualServer description DRAC for Virtual Server (89)
!
interface GigabitEthernet0/0
speed 100
duplex full
nameif outside
security-level 0
ip address 12.43.6.90 255.255.0.0
!
interface GigabitEthernet0/1
speed 100
duplex full
nameif inside
security-level 100
ip address 10.1.252.254 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
passwd ZPTx1zDL8pJ7Ffwu encrypted
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server NS1
name-server 8.8.8.8
domain-name edenhosting.net
access-list inside_access_in extended permit tcp host 12.43.6.91 host NS1 eq domain
access-list inside_access_in extended permit udp host 12.43.6.91 host NS1 eq domain
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq pop3
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq smtp
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq domain
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq 587
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq 465
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq www
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq https
access-list inside_access_in extended permit tcp host 12.43.6.92 host Sendmail eq 8088
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit tcp host 12.43.6.93 host WebServerIIS80 eq www
access-list inside_access_in extended permit ip 10.1.252.0 255.255.255.0 any
pager lines 24
logging enable
logging timestamp
logging buffer-size 999999
logging buffered debugging
logging trap debugging
logging history debugging
logging asdm debugging
logging facility 23
mtu outside 1500
mtu inside 1500
mtu management 1500
ip verify reverse-path interface outside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-522.bin
asdm history enable
arp timeout 14400
nat-control
nat (inside) 1 10.1.252.0 255.255.255.0
static (inside,outside) 12.43.6.91 NS1 netmask 255.255.255.255
static (inside,outside) 12.43.6.92 Sendmail netmask 255.255.255.255 tcp 0 120
static (inside,outside) 12.43.6.93 WebServerIIS80 netmask 255.255.255.255 tcp 0 120
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 12.43.6.81 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
!
!
prompt hostname context
Cryptochecksum:c01c5eda61d05eb6144365d3feb1d611

ciscoasa5540(config)# show version

Cisco Adaptive Security Appliance Software Version 7.2(2)
Device Manager Version 5.2(2)

Compiled on Wed 22-Nov-06 14:16 by builders
System image file is "disk0:/asa722-k8.bin"
Config file at boot was "startup-config"

ciscoasa5540 up 2 hours 41 mins

Hardware: ASA5540-K8, 2560 MB RAM, CPU Pentium 4 2000 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash AT49LW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-1.2
SSL/IKE microcode: CNlite-MC-IPSEC-Admin-3.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
0: Ext: GigabitEthernet0/0 : address is 001a.2f94.4f56, irq 9
1: Ext: GigabitEthernet0/1 : address is 001a.2f94.4f57, irq 9
2: Ext: GigabitEthernet0/2 : address is 001a.2f94.4f58, irq 9
3: Ext: GigabitEthernet0/3 : address is 001a.2f94.4f59, irq 9
4: Ext: Management0/0 : address is 001a.2f94.4f55, irq 11
5: Int: Internal-Data0/0 : address is 0000.0001.0002, irq 11
6: Int: Internal-Control0/0 : address is 0000.0001.0001, irq 5

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited
Maximum VLANs : 200
Inside Hosts : Unlimited
Failover : Active/Active
VPN-DES : Enabled
VPN-3DES-AES : Enabled
Security Contexts : 2
GTP/GPRS : Disabled
VPN Peers : 5000
WebVPN Peers : 10

This platform has an ASA 5540 VPN Premium license.

Serial Number: JMX1112L1JH
Running Activation Key: 0x133c6c4f 0x3cca370e 0x9882a598 0x897810c8 0x0a2c0289
Configuration register is 0x1
Configuration last modified by enable_15 at 18:29:39.206 UTC Fri Aug 2 2019