No Internet Access but connected to domain. New install of Windows 7

[KYLE NGUYEN]

Hi everyone

I have a problem that's driving me nuts trying to troubleshoot. Brand new install of Windows 7 Dell latitude. I'm connected to our domain, but cannot browse the Internet with exclamation icon and msg "No Internet Access."

I can ping all internal servers and gateway. No issues there.

I took the laptop home and connected to my home network fine. Internet connection works perfectly.

But when I get back to the office, I tried connecting with both wired and wireless, both gives msg "No Internet Access."

Firewall is ASA 5505. I did some googling, and found some info on IP Shunning, but when I check my firewall settings, shunning is not enabled. 

Any help is greatly appreciated. Thanks. 

[KYLE NGUYEN]

what should i try next? 

btw, thanks so much for helping me this problem. 

[Marvin Rhoads]

When you are logged into the ASA can you ping one of the new PCs?

We have seen the outbound traffic reach the ASA. Packet-tracer shows it goes through OK. Packet capture shows that return traffic is sent on to the PCs.

The one thing we have not checked is can the return traffic reach the new PCs.

[KYLE NGUYEN]

From the ASA I cannot ping any new PCs. 

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.5, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

I can ping any of the old PCs. That works. 

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.0.38, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

[Marvin Rhoads]

Are 192.168.0.x and 192.168.1.x in the same subnet (i.e. is the mask /23 or such)?

If they are, all all devices set with the correct netmask?

If they are not, how is the ASA supposed to know to return traffic to the 192.168.1.x host - routing or something?

[KYLE NGUYEN]

yes, all devices have the same subnet mask 255.255.254.0

Just for kicks, I rebooted the ASA and it didn't change anything. same problem. 

Nothing was changed on the servers or network before this started happening. The only thing I did was join a new Windows 7 laptop to the network. so strange.

[Marvin Rhoads]

You mentioned it's a 5505.That reminds me...

What license level does it have? The base license on a 5505 is limited to 10 concurrent inside hosts.

show local-host connection | inc licensed

...will show you the status of your system.

Reference: http://www.cisco.com/c/en/us/td/docs/security/asa/asa72/configuration/guide/conf_gd/specs.html#wp1150495

[KYLE NGUYEN]

It shows I have unlimited inside hosts. 

[Marvin Rhoads]

Do the new hosts' addresses show up in the arp cache of the ASA?

"show arp inside"

[KYLE NGUYEN]

After some more troubleshooting, I was able to narrow it down to a switch issue. We have seven Cisco 3850 switches spread throughout the campus.

I took the new laptop to each switch and plugged it in. I was able to connect to the network and ping all internal servers on all of them.

On two of the switches, I cannot connect to the Internet with msg "No Internet Access" even though I can still join domain and ping internal servers. 

What's weird is that old computers that's still connected to these two "problem" switches are still working fine with full internet access. It's only when I try to connect a new device that I lose internet access. 

Does this make any sense?

[Marvin Rhoads]

Some of the newer security features in the IOS-XE based switches like 3850s can make simple things not work. Features like Dynamic ARP inspection, IP device tracking etc.

Why they would allow internal but not external access is a bit of a mystery to me. I'd have to dig into the switch directly to see what's going on there. I could imagine some scenarios but they are a bit uncommon (Private VLANs, downloadable ACLs in an 802.1x environment etc.)

[KYLE NGUYEN]

Thanks for all your help Marvin. Another forum member here directed me this this bug release that was the root of my switch problems. 

Bug Id:	CSCug87540
Title:	3850: traffic L3 routed on 1 switch/member fails for newly added devices
Description:	Symptom:The following symptoms can appear on the impacted switch (which can be standalone or a stack member): - traffic is not routed between devices on different vlans (impacting newly connected devices, or devices that have changed ports) - new routes do not function - qos or ACL changes do not take effect This issue occurs due to a failure to program changes into hardware once the breakage occurs, so existing hardware programming will allow traffic between previously connected devices to continue to flow correctly. Conditions:Seen on Catalyst 3850 stacks running 3.2.0SE, 3.2.1SE and 3.2.2SE. Workaround:None. To recover reload the impacted switch. The issue does not show in 3.3.0(SE) due to code restructure.

[Marvin Rhoads]

Thanks for letting us know the final resolution. 

It's maddening sometimes to find such basic features not working. The earlier IOS-XE code has been very buggy in this regard.