ASA 8.2(4) Having problem with basic setup

[Joshua Engels]

I know my ASA has internet connectivity.  From my ASA I can ping out to 4.2.2.2.  When I put my PC behind the firewall, for some reason I cannot browse the internet.  I'm not sure what the issue is but the config is very basic and it is attached.  My first thought was that I do not have NAT setup correctly but I'm not 100% sure on that.  See attached config.

[varrao]

Hi Joshua,

Are you able to ping the firewall fro the PC?? are you able to ping the next hop from the PC?? Have you tried packet-tracer from firewall?/

packet-tracer input inside tcp ho 23456 ho 2.2.2.2 80 detailed.

can you provide the output for it??

try taking acptures as well on the firewall to check if the packets are reaching the firewall or not.

packet-captures:

https://supportforums.cisco.com/docs/DOC-1222

The config looks fine.

Thanks,

Varun

[Joshua Engels]

Found the issue.  It is with my Management interface.  As soon as I disabled the management interface everything started working.  Any ideas why this is?

[varrao]

Hi Joshua,

On which interface had you connected the laptop???

Varun

[Joshua Engels]

So here is how I am setup.  Diagram attached.

I route through the core switch and then through the ASA to the internet.

To manage the ASA I setup the managment interface on the same vlan I am on so that I can connect directly to it.  It seems that this may be confusing the ASA's return path or something.

[Kureli Sankar · Accepted solution]

Joshua,

This is causing asymmetry. The management network cannot live behind the inside.

You cannot use mgmt ip address and go to the internet via the inside interface. When the response traffic comes back, it will try to take the mgmt interface and fail.

You need to take the same path going and coming.

Best option to solve this is to use a route-map on the switch.

access-list 120 per ip 192.168.99.0 0.0.0.255 any

route-map mgmt per 10

match ip address 120

set ip next-hop 192.168.99.100

-KS