topic Re: Routing to internet from different subnets on asa5520 in Network Security https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743230#M976938 <HTML><HEAD></HEAD><BODY><P>ciscoasa# sh run nat</P><P>nat (Lan) 1 access-list Lan_nat_outbound</P></BODY></HTML> Fri, 06 Jul 2007 15:12:22 GMT kmcilvaine 2007-07-06T15:12:22Z Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743226#M976934 <P>I am setting up a new asa 5520 and have no problems from the subnet that the subnet that the firewall is on. But from my wireless subnet I cannot reach the internet. I added a route from the wireless subnet to the gateway subnet and it doesn't connect.</P> Mon, 11 Mar 2019 10:41:09 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743226#M976934 kmcilvaine 2019-03-11T10:41:09Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743227#M976935 <HTML><HEAD></HEAD><BODY><P>So you have something like..</P><P></P><P>Internet - ASA - inside - inside router - wireless subnet</P><P></P><P>The wireless clients have a dg of the inside router and the inside router has a dg of inside ASA?</P><P></P><P>Do you have a route statement on the ASA for the wireless subnet?</P><P></P><P>route inside <WIRLESS.SUBNET> <MASK> <INSIDE.ROUTER.IP></INSIDE.ROUTER.IP></MASK></WIRLESS.SUBNET></P><P></P><P>Is the wireless subnet included in your nat statement?</P><P></P><P>nat (inside) 1 <WIRELESS.SUBNET> </WIRELESS.SUBNET></P></BODY></HTML> Fri, 06 Jul 2007 14:20:47 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743227#M976935 acomiskey 2007-07-06T14:20:47Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743228#M976936 <HTML><HEAD></HEAD><BODY><P>I have a route statement for the wireless but I do not have a nat rule. Do I need a static nat rule to the subnet?</P><P></P><P>route inside &lt;10.112.5.0&gt; &lt;255.255.255.0&gt; &lt;10.112.4.1&gt;</P><P></P></BODY></HTML> Fri, 06 Jul 2007 15:01:22 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743228#M976936 kmcilvaine 2007-07-06T15:01:22Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743229#M976937 <HTML><HEAD></HEAD><BODY><P>Post a "show run nat"</P><P></P><P>So 10.112.5.0 is the wireless subnet?</P><P></P><P>And 10.112.4.1 is inside router?</P></BODY></HTML> Fri, 06 Jul 2007 15:03:53 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743229#M976937 acomiskey 2007-07-06T15:03:53Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743230#M976938 <HTML><HEAD></HEAD><BODY><P>ciscoasa# sh run nat</P><P>nat (Lan) 1 access-list Lan_nat_outbound</P></BODY></HTML> Fri, 06 Jul 2007 15:12:22 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743230#M976938 kmcilvaine 2007-07-06T15:12:22Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743231#M976939 <HTML><HEAD></HEAD><BODY><P>Ok, how about a "show access-list Lan_nat_outbound"</P></BODY></HTML> Fri, 06 Jul 2007 15:13:48 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743231#M976939 acomiskey 2007-07-06T15:13:48Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743232#M976940 <HTML><HEAD></HEAD><BODY><P>ciscoasa(config)# show access-list Lan_nat_outbound</P><P>access-list Lan_nat_outbound; 1 elements</P><P>access-list Lan_nat_outbound line 1 extended permit ip any any (hitcnt=0) 0x5023</P><P>9b0a</P></BODY></HTML> Fri, 06 Jul 2007 15:15:21 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743232#M976940 kmcilvaine 2007-07-06T15:15:21Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743233#M976941 <HTML><HEAD></HEAD><BODY><P>Also, can you ping the ASA from the wireless subnet? This would rule out a routing problem.</P></BODY></HTML> Fri, 06 Jul 2007 15:15:33 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743233#M976941 acomiskey 2007-07-06T15:15:33Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743234#M976942 <HTML><HEAD></HEAD><BODY><P>yes</P></BODY></HTML> Fri, 06 Jul 2007 15:19:18 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743234#M976942 kmcilvaine 2007-07-06T15:19:18Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743235#M976943 <HTML><HEAD></HEAD><BODY><P>That should work. Do you want to post a sanitized config from the ASA?</P></BODY></HTML> Fri, 06 Jul 2007 15:23:15 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743235#M976943 acomiskey 2007-07-06T15:23:15Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743236#M976944 <HTML><HEAD></HEAD><BODY><P>ASA Version 7.2(2)19 </P><P>! </P><P>hostname ciscoasa </P><P>domain-name xxxxxxx.com </P><P>enable password xxxxxxxxxx encrypted </P><P>names </P><P>dns-guard </P><P>! </P><P>interface GigabitEthernet0/0 </P><P> nameif Wan </P><P> security-level 0 </P><P> ip address 65.x.x.98 255.255.255.224 </P><P>! </P><P>interface GigabitEthernet0/1 </P><P> nameif Lan </P><P> security-level 100 </P><P> ip address 11.x.x.0 255.255.255.0 </P><P>! </P><P>interface GigabitEthernet0/2 </P><P> shutdown </P><P> nameif vpn </P><P> security-level 0 </P><P> ip address 11.x.x.1 255.255.255.0 </P><P>! </P><P>interface GigabitEthernet0/3 </P><P> shutdown </P><P> no nameif </P><P> no security-level </P><P> no ip address </P><P>! </P><P>interface Management0/0 </P><P> nameif management </P><P> security-level 100 </P><P> ip address 192.168.1.1 255.255.255.0 </P><P> management-only </P><P>! </P><P>passwd cxxcxccx encrypted </P><P>boot system disk0:/asa722-19-k8 </P><P>ftp mode passive </P><P>clock timezone EST -5 </P><P>clock summer-time EDT recurring </P><P>dns domain-lookup Wan </P><P>dns server-group DefaultDNS </P><P> name-server 200.100.3.65 </P><P> domain-name xxxxxxxx </P><P>access-list Wan_access_in_1 extended permit tcp host 200.100.15.36 host 65.000.2 </P><P>15.000 eq 3268 </P><P>access-list Wan_access_in_1 extended permit tcp any host 65.000.000.000 eq smtp </P><P></P><P>access-list Wan_access_in_1 extended permit tcp any host 65.000.000.101 eq https </P><P></P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.4 host 65.000.000 </P><P>.107 e </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.4 host 65.000.000 </P><P>.107 eq https </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.4 host 65.000.000 </P><P>.107 eq 1433 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.4 host 65.000.000 </P><P>.107 eq 1414 </P><P></P></BODY></HTML> Fri, 06 Jul 2007 15:40:54 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743236#M976944 kmcilvaine 2007-07-06T15:40:54Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743237#M976945 <HTML><HEAD></HEAD><BODY><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.4 host 65.000.000 </P><P>.107 eq 8088 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.000.4 host 65.00.000 </P><P>.107 eq smtp </P><P>access-list Wan_access_in_1 extended permit tc </P><P>access-list Wan_access_in_1 extended permit tcp any host 65.000.000.104 eq https </P><P></P><P>access-list Wan_access_in_1 extended permit udp any host 65.000.000.108 eq 17335 </P><P></P><P>access-list Wan_access_in_1 extended permit udp any host 65.000.000.108 eq 22334 </P><P></P><P>access-list Wan_access_in_1 extended permit udp any host 65.000.000.108 eq 22335 </P><P></P><P>access-list Wan_access_in_1 extended permit tcp any host 65.000.000.108 eq 5003 </P><P></P><P>access-list Wan_access_in_1 extended permit udp any host 65.000.000.108 eq 5003 </P><P></P><P>access-list Wan_access_in_1 extended permit tcp any host 65.000.000.102 eq lotus </P><P>notes </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.5 host 65.000.000 </P><P>.107 eq www </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.5 host 65.000.000 </P><P>.107 eq https </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.5 host 65.000.000 </P><P>.107 eq 1433 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.5 host 65.000.000 </P><P>.107 eq 1414 </P><P>access-list Wan_access_in_1 extended permit tcp host 6 </P><P>.107 eq 8088 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.5 host 65.000.000 </P><P>.107 eq smtp </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq www </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq https </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq 1433 </P><P></P></BODY></HTML> Fri, 06 Jul 2007 15:42:39 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743237#M976945 kmcilvaine 2007-07-06T15:42:39Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743238#M976946 <HTML><HEAD></HEAD><BODY><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq 8088 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq smtp </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.6 host 65.000.000 </P><P>.107 eq 1414 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.7 host 65.000.000 </P><P>.107 eq www </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.7 host 65.000.000 </P><P>.107 eq https </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.7 host 65.000.000 </P><P>.107 eq 1433 </P><P>access-list Wan_access_in_1 extended permit tcp </P><P>.107 eq 8088 </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.7 host 65.000.000 </P><P>.107 eq smtp </P><P>access-list Wan_access_in_1 extended permit tcp host 66.000.00.7 host 65.000.000 </P><P>.107 eq 1414 </P><P>access-list Lan_nat_outbound extended permit ip </P><P>any any </P><P>pager lines 24 </P><P>logging enable </P><P>logging asdm informational </P><P>mtu Wan 1500 </P><P>mtu Lan 1500 </P><P>mtu vpn 1500 </P><P>mtu management 1500 </P><P>ip local pool Poolip 10.000.00.51-10.000.00.254 mask 255.255.255.0 </P><P>no failover </P><P>icmp unreachable rate-limit 1 burst-size 1 </P><P>asdm image disk0:/asdm-52 </P><P>no asdm history enable </P><P>arp timeout 14400 </P><P>nat-control </P><P>global (Wan) 1 interface </P><P>nat (Lan) 1 access-list Lan_nat_outbound </P><P>static (Lan,Wan) 65.000.000.106 10.00.0.32 netmask 255.255.255.255 </P><P>static (Lan,Wan) 65.000.000.101 10.000.0.47 netmask 255.255.255.255 </P><P>static (Lan,Wan) 65.000.000.107 10.000.00.77 netmask 255.255.255.255 </P><P>static (Lan,Wan) 65.000.000.104 10.000.0.53 netmask 255.255.255.255 </P><P>static (Lan,Wan) 65.000.000.108 10.000.00.17 netmask 255.255.255.255 </P><P>static (Lan,Wan) 65.000.000.102 10.000.00.2 netmask 255.255 </P><P></P></BODY></HTML> Fri, 06 Jul 2007 15:43:30 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743238#M976946 kmcilvaine 2007-07-06T15:43:30Z Re: Routing to internet from different subnets on asa5520 https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743239#M976947 <HTML><HEAD></HEAD><BODY><P>access-group Wan_access_in_1 in interface Wan </P><P>route Wan 0.0.0.0 0.0.0.0 65.000.000.97 1 </P><P>route Lan 10.000.5.0 255.255.255.0 10.000.0.49 1 </P><P>route Lan 10.000.00.0 255.255.255.0 10.000.0.49 1 </P><P>route Lan 10.000.0.0 255.255.255.0 10.000.0.49 1 </P><P>route Lan 10.000.00.0 255.255.255.0 10.000.00.49 1 </P><P>route vpn 65.000.000.98 255.255.255.255 65.000.000.97 1 </P><P>timeout xlate 3:00:00 </P><P>timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 </P><P>timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 </P><P>timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 </P><P>timeout uauth 0:05:00 absolute </P><P>aaa-server 00000 protocol ldap </P><P>aaa-server 0000 (Lan) host 10.000.0.32 </P><P> timeout 5 </P><P> ldap-scope onelevel </P><P>group-policy 00000 internal </P><P>group-policy 00000 attributes </P><P> wins-server value 10.000.0.50 10.000.00.16 </P><P> dns-server value 10.000.00.50 10.000.000.16 </P><P> vpn-tunnel-protocol IPSec </P><P> default-domain value 000000 </P><P>http server enable </P><P>http 192.168.1.0 255.255.255.0 management </P><P>no snmp-server location </P><P>no snmp-server c </P><P>snmp-server enable traps snmp authentication linkup linkdown coldstart </P><P>crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac </P><P>crypto dynamic-map vpn_dyn_map 20 set pfs </P><P>crypto dynamic-map vpn_dyn_map 20 set transform-set ESP-3DES-MD5 </P><P>crypto map vpn_map 65535 ipsec-isakmp dynamic vpn_dyn_map </P><P>crypto map vpn_map interface vpn </P><P>crypto isakmp enable vpn </P><P>crypto isakmp policy 10 </P><P> authentication pre-share </P><P> encryption 3des </P><P> hash md5 </P><P> group 2</P><P> lifetime 86400</P><P>tunnel-group 0000 type ipsec-ra</P><P>tunnel-group 000 general-attributes</P><P> address-pool Poolip</P><P> authentication-server-group 000000</P><P> default-group-policy 000000</P><P>tunnel-group cxcvcx ipsec-attributes</P><P> pre-shared-key *</P><P>telnet timeout 5</P><P>ssh timeout 5</P><P>console timeout 0</P></BODY></HTML> Fri, 06 Jul 2007 15:43:45 GMT https://community.cisco.com/t5/network-security/routing-to-internet-from-different-subnets-on-asa5520/m-p/743239#M976947 kmcilvaine 2007-07-06T15:43:45Z