ASA 5510 - Failed to locate egress interface

[Jeremy Morris]

having a bit of trouble setting up our 5510.  None of us have ever played with a firewall before.  We've got most of the basics covered.  I was able to get to the outside world to do a software update to the box, but my laptop that sits in the inside can't see the outside.  We only have the default access rules in place at the moment.  Our old ISA firewall rules don't really translate all that well to this new box.

Thanks.

Jeremy                  

[r_j_gale]

Hi Jeremy,

There can be a number of things, firstly I'd say check the following

1) Are you running nat-control (sh run nat-control)

2) Do you have any nats setup ( sh run nat, sh run global, sh run static)

3) Check your inside access-list if defined, if not ensure your inside security level is higher than your outside security level.

4) finaly try a packet-trace which should give you some cryptic output, but will help...

    packet-trace input inside icmp 192.168.1.16 8 0 4.2.2.2

(this will do a echo (type 8 code 0) request from interface named "inside" 192.168.1.16 to 4.2.2.2 and shows if its allowed or will be dropped, if the above doesnt help, post the output of this into the errr...post!

Cheers,

Rich

[Jeremy Morris]

that's what it was.  Called tech support and they fixed it in about 10 min.

Thanks.

[veleveque1]

Same problem - was using an old Pix 501, and am having trouble getting the ASA to send internal traffic to the outside. I originally thought it was the lack of a default gateway, but that seems to be configured (When I try to manually set one up, I get a message it is already there).

I'm using ADSM to configure, but logging into the console gives the following config:

!                                                                              
interface Ethernet0/0                                                          
switchport access vlan 2                                                      
!                                                                              
interface Ethernet0/1                                                          
!                                                                              
interface Ethernet0/2                                                          
!                                                                              
interface Ethernet0/3                                                          
!                                                                              
interface Ethernet0/4                                                          
!                                                                              
interface Ethernet0/5                                                          
!                                                                              
interface Ethernet0/6   

!                                                                              
interface Ethernet0/7                                                          
!                                                                              
interface Vlan1                                                                
nameif inside                                                                 
security-level 100                                                            
ip address 192.168.1.1 255.255.255.0                                          
!                                                                              
interface Vlan2                                                                
nameif outside                                                                
security-level 0                                                              
ip address dhcp setroute                                                      
!                                                                              
ftp mode passive                                                               
pager lines 24                                                                 
logging asdm informational                                                     
mtu outside 1500                                                               
mtu inside 1500                                                                
icmp unreachable rate-limit 1 burst-size 1                                     
no asdm history enable                      

arp timeout 14400                                                              
global (outside) 1 interface                                                   
nat (inside) 1 0.0.0.0 0.0.0.0                                                 
timeout xlate 3:00:00                                                          
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02              
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute                   
timeout tcp-proxy-reassembly 0:01:00                                           
timeout floating-conn 0:00:00                                                  
dynamic-access-policy-record DfltAccessPolicy                                  
http server enable                                                             
http 192.168.1.0 255.255.255.0 inside                                          
no snmp-server location                                                        
no snmp-server contact                                                         
snmp-server enable traps snmp authentication linkup linkdown coldstart         
crypto ipsec security-association lifetime seconds 28800                       
crypto ipsec security-association lifetime kilobytes 4608000                   
telnet timeout 5                                                               
ssh timeout 5                                                                  
console timeout 0                                                              
dhcpd auto_config outside   

!                                                                              
dhcpd address 192.168.1.5-192.168.1.132 inside                                 
dhcpd enable inside                                                            
!                                                                              
                                                                               
threat-detection basic-threat                                                  
threat-detection statistics access-list                                        
no threat-detection statistics tcp-intercept                                   
webvpn                                                                         
!                          inspect h323 ras                                                             
  inspect rsh                                                                  
  inspect rtsp                                                                 
  inspect esmtp                                                                
  inspect sqlnet                                                               
  inspect skinny                                                               
  inspect sunrpc                                                               
  inspect xdmcp                                                                
  inspect sip                                                                  
  inspect netbios                                                              
  inspect tftp                                                                 
  inspect ip-options                                                           
!                                                                              
service-policy global_policy global                                            
prompt hostname context                                
  inspect ftp                                                                  
  inspect h323 h225