Sankar,
Thank you for the help. But traffic still seems to be blocked (icmp, dns, h323, sip, ftp, ssh,....). I will give you my entire configuration (I added ----- in places that are sensitive). On the outside I have 3 servers two are for dns, ftp, http and one is for voip. On the inside I have a router 3825 and behind the router i have a switch and then I have the client devices.
ASA Version 8.0(4)
!
hostname ----------
domain-name -----------
enable password -------------- encrypted
passwd ---------------- encrypted
names
!
interface Ethernet0/0
nameif inside
security-level 100
ip address 10.0.0.1 255.255.255.252
!
interface Ethernet0/1
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
nameif outside
security-level 0
ip address 172.16.0.1 255.255.255.0
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 172.16.0.251
name-server 172.16.0.252
domain-name ---------------
same-security-traffic permit inter-interface
access-list INSIDEACL extended permit ip any any log warnings
access-list OUTSIDEACL extended permit ip any any log warnings
pager lines 24
logging enable
logging timestamp
logging trap warnings
logging asdm informational
logging device-id hostname
logging host outside 172.16.0.251
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any echo inside
icmp permit any echo-reply inside
icmp permit any echo outside
icmp permit any echo-reply outside
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group INSIDEACL in interface inside
access-group OUTSIDEACL in interface outside
!
router ospf 100
network 10.0.0.0 255.255.255.252 area 0
network 172.16.0.0 255.255.255.0 area 0
log-adj-changes
!
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication telnet console LOCAL
aaa authentication http console LOCAL
aaa authentication secure-http-client
http server enable
http 172.16.0.0 255.255.255.0 outside
http redirect inside 80
snmp-server host outside 172.16.0.251 community ---------- version 2c
no snmp-server location
no snmp-server contact
snmp-server community ------------
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet 172.16.0.1 255.255.255.255 outside
telnet timeout 5
ssh 172.16.0.0 255.255.255.0 outside
ssh 172.16.0.251 255.255.255.255 outside
ssh 172.16.0.252 255.255.255.255 outside
ssh timeout 5
ssh version 1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 172.16.0.251
ntp server 172.16.0.252
ssl certificate-authentication interface inside port 443
username ------------ password -------------------------- encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect dns preset_dns_map
inspect icmp
inspect mgcp
inspect snmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:---------------------------------------------
: end
-lp
Welcome to the Cisco Networking Professionals Ask the Expert conversation. This is an opportunity to learn how to address and troubleshoot common problems with Adaptive Security Appliances, Private Internet Exchange and Firewall Service Modules with Kureli Sankar. Kureli is an engineer supporting Cisco's firewall team in Research Triangle Park, North Carolina. Her team supports the Cisco Adaptive Security Appliance, Firewall Services Module, Cisco Security Manager, the Content Security and Control module, and the Zone Based Firewall module in Cisco IOS Software.
