Can't access certain websites

[ematelyan]

Hello,

I'm having an issue with my firewall, and I absolutely can't figure it out.

I can access the internet fine.  However, a few select websites are not working (www.yahoo.com)

I can ping google.com, but I can't ping yahoo.com.

This wouldn't be a big deal, but another site popped up that isn't working, and it's a site we need for work.  What am I missing on here?

Result of the command: "show run"

: Saved
:
ASA Version 8.2(5)
!

!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.5.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 98.101.139.210 255.0.0.0
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup inside
dns server-group DefaultDNS
name-server 24.25.5.60
name-server 24.25.5.61
same-security-traffic permit intra-interface
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list Wayne_Access extended permit ip 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list Wayne_Access extended permit ip 192.168.5.0 255.255.255.0 192.168.10.0 255.255.255.0
access-list Shelton_Access extended permit ip 192.168.5.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list out_access_in extended permit tcp any host 98.101.139.210 eq www
access-list out_access_in extended permit tcp any host 98.101.139.210 eq ftp
access-list out_access_in extended permit udp any host 98.101.139.210 eq tftp
access-list out_access_in extended permit udp any host 98.101.139.210 eq sip
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 5090
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 2001
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 5080
access-list out_access_in extended permit tcp any host 98.101.139.210 eq ssh
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 81
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 56774
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 5000
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 902
access-list out_access_in extended permit tcp any host 98.101.139.210 eq netbios-ssn
access-list out_access_in extended permit tcp any host 98.101.139.210 eq 445
access-list out_access_in extended permit tcp any host 98.101.139.210 eq https
access-list out_access_in extended permit object-group TCPUDP any host 98.101.139.210 eq 3389
access-list out_access_in extended permit object-group TCPUDP any host 98.101.139.210 range 5480 5487
access-list out_access_in extended permit udp any host 98.101.139.210 range 9000 9050
access-list inside_nat0 extended permit ip 192.168.5.0 255.255.255.0 192.168.1.0 255.255.255.0
access-list inside_nat0 extended permit ip 192.168.5.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list inside_nat0 extended permit ip 192.168.5.0 255.255.255.0 192.168.10.0 255.255.255.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface www 192.168.5.52 8080 netmask 255.255.255.255
static (inside,outside) tcp interface ftp 192.168.5.10 ftp netmask 255.255.255.255
static (inside,outside) udp interface tftp 192.168.5.10 tftp netmask 255.255.255.255
static (inside,outside) udp interface sip 192.168.5.11 sip netmask 255.255.255.255
static (inside,outside) tcp interface 5090 192.168.5.11 5090 netmask 255.255.255.255
static (inside,outside) tcp interface 2001 192.168.5.10 2001 netmask 255.255.255.255
static (inside,outside) tcp interface 5080 192.168.5.11 5080 netmask 255.255.255.255
static (inside,outside) tcp interface ssh 192.168.5.200 ssh netmask 255.255.255.255
static (inside,outside) tcp interface 81 192.168.5.20 www netmask 255.255.255.255
static (inside,outside) tcp interface 56774 192.168.5.10 1823 netmask 255.255.255.255
static (inside,outside) tcp interface 5000 192.168.5.11 5000 netmask 255.255.255.255
static (inside,outside) tcp interface 902 192.168.5.12 902 netmask 255.255.255.255
static (inside,outside) tcp interface netbios-ssn 192.168.5.12 netbios-ssn netmask 255.255.255.255
static (inside,outside) tcp interface 445 192.168.5.12 445 netmask 255.255.255.255
static (inside,outside) tcp interface https 192.168.5.12 https netmask 255.255.255.255
static (inside,outside) udp interface 3389 192.168.5.10 3389 netmask 255.255.255.255
static (inside,outside) tcp interface 3389 192.168.5.10 3389 netmask 255.255.255.255
static (inside,outside) tcp interface 5480 192.168.5.11 5480 netmask 255.255.255.255
static (inside,outside) tcp interface 5481 192.168.5.11 5481 netmask 255.255.255.255
static (inside,outside) tcp interface 5482 192.168.5.11 5482 netmask 255.255.255.255
static (inside,outside) tcp interface 5483 192.168.5.11 5483 netmask 255.255.255.255
static (inside,outside) tcp interface 5484 192.168.5.11 5484 netmask 255.255.255.255
static (inside,outside) tcp interface 5485 192.168.5.11 5485 netmask 255.255.255.255
static (inside,outside) tcp interface 5486 192.168.5.11 5486 netmask 255.255.255.255
static (inside,outside) tcp interface 5487 192.168.5.11 5487 netmask 255.255.255.255
static (inside,outside) udp interface 5480 192.168.5.11 5480 netmask 255.255.255.255
static (inside,outside) udp interface 5481 192.168.5.11 5481 netmask 255.255.255.255
static (inside,outside) udp interface 5482 192.168.5.11 5482 netmask 255.255.255.255
static (inside,outside) udp interface 5483 192.168.5.11 5483 netmask 255.255.255.255
static (inside,outside) udp interface 5484 192.168.5.11 5484 netmask 255.255.255.255
static (inside,outside) udp interface 5485 192.168.5.11 5485 netmask 255.255.255.255
static (inside,outside) udp interface 5486 192.168.5.11 5486 netmask 255.255.255.255
static (inside,outside) udp interface 5487 192.168.5.11 5487 netmask 255.255.255.255
static (inside,outside) udp interface 9000 192.168.5.11 9000 netmask 255.255.255.255
static (inside,outside) udp interface 9001 192.168.5.11 9001 netmask 255.255.255.255
static (inside,outside) udp interface 9002 192.168.5.11 9002 netmask 255.255.255.255
static (inside,outside) udp interface 9003 192.168.5.11 9003 netmask 255.255.255.255
static (inside,outside) udp interface 9004 192.168.5.11 9004 netmask 255.255.255.255
static (inside,outside) udp interface 9005 192.168.5.11 9005 netmask 255.255.255.255
static (inside,outside) udp interface 9006 192.168.5.11 9006 netmask 255.255.255.255
static (inside,outside) udp interface 9007 192.168.5.11 9007 netmask 255.255.255.255
static (inside,outside) udp interface 9008 192.168.5.11 9008 netmask 255.255.255.255
static (inside,outside) udp interface 9009 192.168.5.11 9009 netmask 255.255.255.255
static (inside,outside) udp interface 9010 192.168.5.11 9010 netmask 255.255.255.255
static (inside,outside) udp interface 9011 192.168.5.11 9011 netmask 255.255.255.255
static (inside,outside) udp interface 9012 192.168.5.11 9012 netmask 255.255.255.255
static (inside,outside) udp interface 9013 192.168.5.11 9013 netmask 255.255.255.255
static (inside,outside) udp interface 9014 192.168.5.11 9014 netmask 255.255.255.255
static (inside,outside) udp interface 9015 192.168.5.11 9015 netmask 255.255.255.255
static (inside,outside) udp interface 9016 192.168.5.11 9016 netmask 255.255.255.255
static (inside,outside) udp interface 9017 192.168.5.11 9017 netmask 255.255.255.255
static (inside,outside) udp interface 9018 192.168.5.11 9018 netmask 255.255.255.255
static (inside,outside) udp interface 9019 192.168.5.11 9019 netmask 255.255.255.255
static (inside,outside) udp interface 9020 192.168.5.11 9020 netmask 255.255.255.255
static (inside,outside) udp interface 9021 192.168.5.11 9021 netmask 255.255.255.255
static (inside,outside) udp interface 9022 192.168.5.11 9022 netmask 255.255.255.255
static (inside,outside) udp interface 9023 192.168.5.11 9023 netmask 255.255.255.255
static (inside,outside) udp interface 9024 192.168.5.11 9024 netmask 255.255.255.255
static (inside,outside) udp interface 9025 192.168.5.11 9025 netmask 255.255.255.255
static (inside,outside) udp interface 9026 192.168.5.11 9026 netmask 255.255.255.255
static (inside,outside) udp interface 9027 192.168.5.11 9027 netmask 255.255.255.255
static (inside,outside) udp interface 9028 192.168.5.11 9028 netmask 255.255.255.255
static (inside,outside) udp interface 9029 192.168.5.11 9029 netmask 255.255.255.255
static (inside,outside) udp interface 9030 192.168.5.11 9030 netmask 255.255.255.255
static (inside,outside) udp interface 9031 192.168.5.11 9031 netmask 255.255.255.255
static (inside,outside) udp interface 9032 192.168.5.11 9032 netmask 255.255.255.255
static (inside,outside) udp interface 9033 192.168.5.11 9033 netmask 255.255.255.255
static (inside,outside) udp interface 9034 192.168.5.11 9034 netmask 255.255.255.255
static (inside,outside) udp interface 9035 192.168.5.11 9035 netmask 255.255.255.255
static (inside,outside) udp interface 9036 192.168.5.11 9036 netmask 255.255.255.255
static (inside,outside) udp interface 9037 192.168.5.11 9037 netmask 255.255.255.255
static (inside,outside) udp interface 9038 192.168.5.11 9038 netmask 255.255.255.255
static (inside,outside) udp interface 9039 192.168.5.11 9039 netmask 255.255.255.255
static (inside,outside) udp interface 9040 192.168.5.11 9040 netmask 255.255.255.255
static (inside,outside) udp interface 9041 192.168.5.11 9041 netmask 255.255.255.255
static (inside,outside) udp interface 9042 192.168.5.11 9042 netmask 255.255.255.255
static (inside,outside) udp interface 9043 192.168.5.11 9043 netmask 255.255.255.255
static (inside,outside) udp interface 9044 192.168.5.11 9044 netmask 255.255.255.255
static (inside,outside) udp interface 9045 192.168.5.11 9045 netmask 255.255.255.255
static (inside,outside) udp interface 9046 192.168.5.11 9046 netmask 255.255.255.255
static (inside,outside) udp interface 9047 192.168.5.11 9047 netmask 255.255.255.255
static (inside,outside) udp interface 9048 192.168.5.11 9048 netmask 255.255.255.255
static (inside,outside) udp interface 9049 192.168.5.11 9049 netmask 255.255.255.255
static (inside,outside) udp interface 9050 192.168.5.11 9050 netmask 255.255.255.255
access-group out_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 98.101.139.209 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set WayneTransform esp-3des esp-md5-hmac
crypto ipsec transform-set SheltonTransform esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map IPSec_map 1 match address Wayne_Access
crypto map IPSec_map 1 set pfs group1
crypto map IPSec_map 1 set peer 70.91.18.205
crypto map IPSec_map 1 set transform-set WayneTransform
crypto map IPSec_map 2 match address Shelton_Access
crypto map IPSec_map 2 set pfs group1
crypto map IPSec_map 2 set peer 50.199.234.229
crypto map IPSec_map 2 set transform-set SheltonTransform
crypto map IPSec_map interface outside
crypto isakmp enable outside
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
management-access inside
dhcpd auto_config outside
!
dhcpd address 192.168.5.100-192.168.5.199 inside
dhcpd dns 24.25.5.60 24.25.5.61 interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username eric password 0vcSd5J/TLsFy7nU encrypted privilege 15
tunnel-group 50.199.234.229 type ipsec-l2l
tunnel-group 50.199.234.229 ipsec-attributes
pre-shared-key *****
tunnel-group 70.91.18.205 type ipsec-l2l
tunnel-group 70.91.18.205 ipsec-attributes
pre-shared-key *****
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:3d770ba9647ffdc22b3637e1e5b9a955
: end

[Julio Carvajal]

Hello Eric,

Are those DNS servers okay ( I would say you are also running them on your internal machines )

dns server-group DefaultDNS

name-server 24.25.5.60

name-server 24.25.5.61

I don't think the ASA is blocking the traffic as traffic from in to out is allowed on your config but here is my recommendations:

- Get the IP address of the specific site you are trying to access(the one you need to work)

-Create a capture matching http traffic from an internal machine to this website ip address ( capture applied to both the inside and outside interface)

-Download the capture on wireshark and determine what is going on

Regards

Julio Carvajal

[ematelyan]

Could you give me a hand with the syntax for doing a packet capture?  I see several different ways to do it online, and I want to make sure I'm doing it right.

I'm trying to access this link, https://vpn.1800packrat.com:10443/remote/login

I'm plugged directly into the ASA, and it's still just timing out when I try to open the link.

This link worked earlier this week, but I put this firewall in on Wednesday, and the link stopped working after that, so I'm pretty sure it's related to the firewall.

[Julio Carvajal]

capture inside interface inside match tcp host inside_host ip host Outside_https_server_ip eq 443

capture capout interface outside match tcp host NAT_IP_inside_host host Outside_https_server_ip eq 443

Remember to rate all of the helpful posts

[ematelyan]

I entered the two commands below,

capture capin interface inside match ip host 192.168.5.11 host 98.101.134.98

capture capout interface outside match ip host 98.101.139.210 host 98.101.134.98

Then I tried to access the website, https://vpn.1800packrat.com:10443/remote/login

I checked the packet capture on the ASA, and got the results below,

Result of the command: "show capture capin"

3 packets captured

1: 12:10:01.466604 802.1Q vlan#1 P0 192.168.5.11.1078 > 98.101.134.98.10443: S 3132314592:3132314592(0) win 65535
2: 12:10:04.481023 802.1Q vlan#1 P0 192.168.5.11.1078 > 98.101.134.98.10443: S 3132314592:3132314592(0) win 65535
3: 12:10:10.514682 802.1Q vlan#1 P0 192.168.5.11.1078 > 98.101.134.98.10443: S 3132314592:3132314592(0) win 65535
3 packets shown

Result of the command: "show capture capout"

0 packet captured

0 packet shown

So it looks like packets are going into the ASA, and not leaving.  Could this be caused by one of the Static NAT Rules?

[Julio Carvajal]

Hello Eric,

Are you performig a NAT on the ASA for that particular web-server?

Physically, is the server connected on the outside interface of the ASA? or inside?

Do the following and provide the output

packet-tracer input inside tcp 192.168.5.11 1027 98.101.134.98 443

Regards,

[ematelyan]

I am not performing NAT on this particular webserver, and the server is on the outside interface, out on the internet.

The reason I ask, is that I swapped the previous router with the ASA 5505, and copied all of the NAT rules, as I wasn't sure exactly what they did or did not need.  i was thinking maybe I input something that was causing a conflict.

Here's the output,

Result of the command: "packet-tracer input inside tcp 192.168.5.11 1027 98.101.134.98 443"

Phase: 1
Type: CAPTURE
Subtype:
Result: ALLOW
Config:
Additional Information:
MAC Access list

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 3
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   98.0.0.0        255.0.0.0       outside

Phase: 4
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:

Phase: 5
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
static (inside,outside) udp interface sip 192.168.5.11 sip netmask 255.255.255.255
  match udp inside host 192.168.5.11 eq 5060 outside any
    static translation to 98.101.139.210/5060
    translate_hits = 781, untranslate_hits = 34065
Additional Information:

Phase: 7
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
  match ip inside any outside any
    dynamic translation to pool 1 (98.101.139.210 [Interface PAT])
    translate_hits = 18997, untranslate_hits = 334
Additional Information:
Dynamic translate 192.168.5.11/1027 to 98.101.139.210/42044 using netmask 255.255.255.255

Phase: 8
Type: HOST-LIMIT
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 9
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:

Phase: 10
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 122434, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

[Julio Carvajal]

Hello Eric,

The configuration looks good, packet tracer looks good

Do the captures again and add the following capture as well

cap asp type asp-drop all circular-buffer

Then start the connection and share

show cap capin

show cap capout

show cap asp | include x.x.x.x (IP address of the HTTPS server)

Regards

[ematelyan]

I've entered these 3 commands.  The "show cap asp | include 98.101.134.98" command isn't returning anything.

capture capin interface inside match ip host 192.168.5.11 host 98.101.134.98

capture capout interface outside match ip host 98.101.139.210 host 98.101.134.98

cap asp type asp-drop all circular-buffer

Here are the results,

Result of the command: "show capture capin"

3 packets captured

   1: 12:57:57.319349 802.1Q vlan#1 P0 192.168.5.11.4214 > 98.101.134.98.10443: S 2493633550:2493633550(0) win 65535
   2: 12:58:00.258546 802.1Q vlan#1 P0 192.168.5.11.4214 > 98.101.134.98.10443: S 2493633550:2493633550(0) win 65535
   3: 12:58:06.292205 802.1Q vlan#1 P0 192.168.5.11.4214 > 98.101.134.98.10443: S 2493633550:2493633550(0) win 65535
3 packets shown

Result of the command: "show capture capout"

0 packet captured

0 packet shown

Result of the command: "show cap asp | include 98.101.134.98"

[Julio Carvajal]

Hello Eric,

The cap asp will show the packets that are being drop by the ASA,

So we are not getting any packets drop(at least based on the capture) but traffic is not going out the ASA, HMM.

You are testing this with a real connection right??? Not with a packet-tracer???

Also why are you going on port 10443 to the server?

[ematelyan]

I'm testing from a physical machine (192.168.5.11), inside the network. Opening up Internet Explorer, and putting in the link in the address bar.  It just times out everytime.   I'm not using packet tracer.

This is a customer's site, and this is the instructions they gave us to connect to their VPN, on port 10443.  It works when I try the link from home, or even from another office.  Just in this specific office, it won't work.

[Julio Carvajal]

Hello Eric,

Not sure I get it, So this will go over the internet, this does not go through a VPN tunnel right?

[ematelyan]

Correct, this is a site out on the internet.  It's not going through a VPN tunnel.  This is a Customer's vpn site, not ours.

[ematelyan · Accepted solution]

I was able to figure out the problem.

I had the outside interface configured as

ip address 98.101.139.210 255.0.0.0

It should be

ip address 98.101.139.210 255.255.255.252

Coincidentally, the two sites that weren't working both had 98.x.x.x IP addresses, so it was thinking that they were on the connected network.  This explains why other websites worked, but those two didn't.

After the change, all seems to be working fine.

[Julio Carvajal]

Hello Eric,

Makes sense,

Thanks for sharing that with the community,