topic Re: New ASA installation in Network Security

New ASA installation

jglover72 — Mon, 11 Mar 2019 11:59:29 GMT

I have a new ASA 5510 that is behind our router/firewall. I am having some problems with configuration and not sure where I am hung up. I can't ping the internal Lan, 192.168.1. addresses. I have attached my configuration.

Re: New ASA installation

acomiskey — Tue, 05 Feb 2008 18:23:52 GMT

Seeing as you're not natting, the clients on 192.168.1.0 that you are trying to ping would have to have a route to the 192.168.10.0 network via the outside interface of the ASA, 192.168.1.22.

Also, this route stament is not correct as 192.168.1.0 is on the outside of the ASA.

route inside 192.168.0.0 255.255.0.0 192.168.10.1 1

Re: New ASA installation

patil_pritam — Tue, 05 Feb 2008 18:30:50 GMT

copy paste this two lines

access-list acl_in permit ip any any

access-group acl_in in interface inside

Re: New ASA installation

jglover72 — Tue, 05 Feb 2008 18:37:30 GMT

Sorry for my ignorance as I am new to the ASA's. I have attached my "new" config. I tried adding the two lines and had no luck. I also changed the route inside to outside and had no luck.

Re: New ASA installation

acomiskey — Tue, 05 Feb 2008 18:41:23 GMT

I would disregard the previous post, as you do not need that inside acl.

This is not right either...

route outside 192.168.0.0 255.255.0.0 192.168.10.1 1

You can put back what you had, but would be a good idea to be more specific as all 192.168.0.0/16 networks are not on the inside as 192.168.1.0 is on the outside. For exmaple, if the networks accessed by 192.168.10.1 were 192.168.2.0 and 192.168.3.0 then...

route inside 192.168.2.0 255.255.255.0 192.168.10.1

route inside 192.168.3.0 255.255.255.0 192.168.10.1

You need a way for the clients on 192.168.1.0 to route to 192.168.1.22 when accessing 192.168.10.0. For example, if you had an outside router you could do...

ip route 192.168.10.0 255.255.255.0 192.168.1.22

Re: New ASA installation

patil_pritam — Tue, 05 Feb 2008 18:51:21 GMT

What you can do is, just check the gateway of that 192.168.1.0 clients it should be 192.168.1.22 if that clients have different gateway address (another router) then that router should have route back to the ASA for your 192.168.10.0 network.

for an example in the router command should be

ip route 192.168.10.0 255.255.255.0 192.168.1.22

Re: New ASA installation

patil_pritam — Tue, 05 Feb 2008 18:53:07 GMT

for an example in the router command should be

ip route 192.168.10.0 255.255.255.0 192.168.1.22

Re: New ASA installation

patil_pritam — Wed, 06 Feb 2008 15:21:04 GMT

remove your current nat statement

and add the following statement

static (inside,outside) 192.168.10.0 192.168.10.0 netmask 255.255.255.0 0 0

Re: New ASA installation

jglover72 — Wed, 06 Feb 2008 15:26:54 GMT

Thanks, got it working. I need to know the ports than I need to pass to the ASA with my existing router/firewall as the ASA will be behind the existing.

Can you help me with that?

Re: New ASA installation

patil_pritam — Wed, 06 Feb 2008 15:32:44 GMT

which command solved your pinging problem?

from inside ping to outside?