We have a 5/5 (Flexlink) connection from Sonic.net on a Adtran NetVsta 832 gateway.
We have recently upgraded the firewall on this connection from a PIX515E to a ASA 5505 (ASA 5505 Security Plus license).
I have had issues with ARP on this connction where if i swapped the firewall, i had to call them to clear the ARP on the "ISP" side for the connection to work. That used to work with PIX, but not with ASA firewalls.
The connection drops every 4 hours for a min or so (When i had ASA Version 8.2(5)) installed , which i suspect is when the ARP times out on the ISP side. I have tested the some configuration on a different WAN connction and it seem ok. So i have norrowed this issue down to an ISP ARP issue and as always when i call... they tell me that the connction is fine on their end.
I have gone back to using the PIX for now .
My questestion is how do i make the ASA to behave the same as the PIX when answering ARP requests. When i upgraded to ASA Version 9.1(3)2, i cannot even get a connection to the internet.
I have tried
no arp permit-nonconnected
arp permit-nonconnected
arp timeout 14400
arp timeout 800
no joy.
Any suggetions
:
ASA Version 9.1(3)2
!
hostname XXXXXXXXXXXX
domain-name XXXXXXXXXXXX
enable password XXXXXXXXXXXX encrypted
passwd XXXXXXXXXXXX encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description VoIP-LAN
nameif inside
security-level 100
ip address 192.168.1.x 255.255.255.0
!
interface Vlan2
description WAN Connection
nameif outside
security-level 0
ip address XXXXXXXXXXXX 255.255.255.x
!
boot system disk0:/asa913-2-k8.bin
ftp mode passive
clock timezone PST -8
clock summer-time PDT recurring
dns server-group DefaultDNS
domain-name XXXXXXXXXXXX
object network inside1
subnet 192.168.1.0 255.255.255.0
object network VoIP-SRVR
host 192.168.1.x
object network VoIP-NOC
host 192.168.1.x
object network VoIP-TEST-SRVR
host 192.168.1.x
object network VoIP-WEB-SRVR
host 192.168.1.x
object-group network Bad-guys-blocked-ips
network-object 41.0.0.0 255.0.0.0
network-object 58.0.0.0 255.0.0.0
network-object 59.0.0.0 255.0.0.0
network-object 102.0.0.0 255.0.0.0
network-object 105.0.0.0 255.0.0.0
network-object 154.0.0.0 255.0.0.0
network-object 157.0.0.0 255.0.0.0
network-object 177.0.0.0 255.0.0.0
network-object 179.0.0.0 255.0.0.0
network-object 181.0.0.0 255.0.0.0
network-object 183.0.0.0 255.0.0.0
network-object 184.106.0.0 255.255.0.0
network-object 186.0.0.0 255.0.0.0
network-object 187.0.0.0 255.0.0.0
network-object 188.0.0.0 255.0.0.0
network-object 189.0.0.0 255.0.0.0
network-object 190.0.0.0 255.0.0.0
network-object 191.0.0.0 255.0.0.0
network-object 196.0.0.0 255.0.0.0
network-object 200.0.0.0 255.0.0.0
network-object 201.0.0.0 255.0.0.0
network-object 220.0.0.0 255.0.0.0
object-group service VOIP-SIP-PORTS
description VOIP SIP ports Cisco Phones
service-object udp destination range 50000 52000
service-object udp destination range sip 5061
object-group service VOIP-RTP-PORTS
description VoIP-RTP-Media-Start/Stop-Port-Range
service-object udp destination range 10000 20000
object-group service VoIP-Srvr-access-PORTS
description Access to VoIP server Services
service-object tcp destination eq www
service-object tcp destination eq https
service-object udp destination eq tftp
service-object tcp destination eq 4445
service-object udp destination eq ntp
object-group service Web-Srvr-access-PORTS
description Access to Web server Services
service-object tcp destination eq 8081
service-object tcp destination eq www
object-group network HQ-Office
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
object-group network remote-offices
network-object XXXXXXXXXXXX 255.255.255.x
network-object host XXXXXXXXXXXX
network-object host XXXXXXXXXXXX
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object host XXXXXXXXXXXX
network-object host XXXXXXXXXXXX
network-object host XXXXXXXXXXXX
object-group network VOIP-PROVIDERS
description VOIP-SERVICE-PROVIDERS Networks
network-object host XXXXXXXXXXXX
network-object host XXXXXXXXXXXX
network-object host XXXXXXXXXXXX
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
network-object XXXXXXXXXXXX 255.255.255.x
access-list world extended deny ip object-group Bad-guys-blocked-ips any
access-list world extended permit ip object-group HQ-Office any
access-list world extended permit tcp host XXXXXXXXXXXX host 192.168.1.X eq ssh
access-list world extended permit object-group VOIP-RTP-PORTS any host 192.168.1.x
access-list world extended permit object-group VOIP-SIP-PORTS object-group remote-offices host 192.168.1.x
access-list world extended permit object-group VOIP-SIP-PORTS object-group VOIP-PROVIDERS host 192.168.1.x
access-list world extended permit object-group VoIP-Srvr-access-PORTS object-group remote-offices host 192.168.1.x
access-list world extended permit object-group Web-Srvr-access-PORTS object-group remote-offices host 192.168.1.x
access-list world extended permit icmp object-group remote-offices host 192.168.1.x
access-list world extended permit icmp host XXXXXXXXXXXX host 192.168.1.x
access-list world extended permit icmp any any echo-reply
access-list world extended permit icmp any any source-quench
access-list world extended permit icmp any any unreachable
access-list world extended permit icmp any any time-exceeded
pager lines 24
logging enable
logging trap informational
logging asdm informational
logging host inside 192.168.1.x format emblem
mtu inside 1500
mtu outside 1500
ip verify reverse-path interface inside
ip verify reverse-path interface outside
ip audit name OUTSIDE_ATTACK attack action alarm drop
ip audit name OUTSIDE_INFO info action alarm
ip audit name INSIDE_ATTACK attack action alarm drop reset
ip audit name INSIDE_INFO info action alarm
ip audit interface inside INSIDE_INFO
ip audit interface inside INSIDE_ATTACK
ip audit interface outside OUTSIDE_INFO
ip audit interface outside OUTSIDE_ATTACK
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-714.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network inside1
nat (any,outside) dynamic interface
object network VoIP-SRVR
nat (inside,outside) static XXXXXXXXXXXX
object network VoIP-NOC
nat (inside,outside) static XXXXXXXXXXXX
object network VoIP-TEST-SRVR
nat (inside,outside) static XXXXXXXXXXXX
object network VoIP-WEB-SRVR
nat (inside,outside) static XXXXXXXXXXXX
access-group world in interface outside
route outside 0.0.0.0 0.0.0.0 XXXXXXXXXXXX 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 192.168.1.0 255.255.255.255 inside
ssh timeout 30
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.168.1.x source inside
username XXXXXXXXXXXX password XXXXXXXXXXXX encrypted privilege 15
!
class-map Voice
match dscp ef
class-map inspection_tftp
match default-inspection-traffic
class-map class_sip_udp
match port udp eq sip
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect netbios
inspect tftp
inspect ip-options
policy-map Voicepolicy
class Voice
priority
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:1eefa1df35e9273021ad5760e7e272b0
: end
