08-27-2014 09:53 PM - edited 03-11-2019 09:41 PM
Good day to all!
Sorry if I post this on the wrong group, I am having a bit of a problem on configuring an ASA 5505 firewall. And I scoured google but can't seem to find a specific link to my issues.
It is on a routed mode, have successfully configured inside and outside vlans. Hosts inside vlan can ping each other. Hosts on outside vlan can also ping each other. Problem is, when I am pinging 8.8.8.8, I received ????? Please see config below.
Any help greatly appreciated.
TIA!
##################
: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasan
enable password bD3fGYMFeJJTATOJ encrypted
passwd 2KF1w9ErdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
description INSIDE
nameif inside
security-level 100
ip address 10.10.10.2 255.255.255.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
ip address 203.127.68.2 255.255.255.240
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list outside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 203.127.68.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
http authentication-certificate inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh 10.10.10.0 255.255.255.0 inside
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
anyconnect-essentials
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:6b3e0ce99eda3d2563cf9f392f8001b7
: end
08-28-2014 12:12 AM
hi,
you can move this thread under Security > Firewalling forum to get better feedback.
could you ping 203.127.68.1?
try to connect a laptop and assign .2 and see if you can ping the ISP hop.
make sure you've got a route back to the 'inside' interface if you've got a router or another layer 3 device behind the ASA.
route inside 10.10.10.0 255.255.255.0 10.10.10.1
08-28-2014 12:36 AM
Can you execute a traceroute 8.8.8.8 source Vlan2 ?
08-28-2014 06:57 PM
08-28-2014 08:09 PM
hi,
how about when you just connect a laptop and assign the .2 and ping out?
i suspect an ISP/routing issue.
your config looks fine.
08-28-2014 11:58 PM
08-28-2014 06:56 PM
08-28-2014 09:16 AM
Hi badingdong,
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Remove these lines:
no nat (inside,outside) after-auto source dynamic any interface
no access-group outside_access_in in interface outside
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you have more inside subnets need access to internet, please make sure that you have a static route in place as shown below.
route inside 10.0.0.0 255.0.0.0 10.10.10.1
Also make sure that you have a correct DNS server is assigned on your internal hosts.
Thanks
Rizwan Rafeek
08-28-2014 07:08 PM
08-28-2014 08:14 PM
Hi badingdong,
I assume your inside is "interface Ethernet0/1" if so you assign it to vlan 1.
interface Ethernet0/1
switchport access vlan 1
Like I mentioned before you would not need two lines to access the internet.
Let me know please.
thanks
Rizwan Rafeek
08-28-2014 08:14 PM
08-28-2014 10:57 PM
You are now missing your NAT statements. add the following:
object network obj_any
nat (inside,outside) dynamic interface
So you are able to ping the ISP (203.127.68.1) from the ASA, ? I would agree with John in that this seems a lot like an ISP problem rather than a problem with your ASA. I suggest contacting your ISP and have them check out you connection.
--
Please remember to select a correct answer and rate helpful posts
08-28-2014 11:07 PM
08-28-2014 11:29 PM
I did not expect to solve the issue, but they are needed there so that the inside clients are able to reach the internet....once that is up and running.
If you have both CLI and ASDM open (open the realtime log viewer in ASDM) and ping 8.8.8.8 from the ASA do you see anything that might indicate that the ASA is dropping the return packets?
Another thing you could try is to do a packet capture between the inside and outside interfaces, and then ping 8.8.8.8 from a PC on the inside network. Do you see return traffick coming in the outside interface?
http://ipfield.net/2013/06/asa-packet-capture-using-cli-and-asdm-config-example/
--
Please remember to select a correct answer and rate helpful posts
08-28-2014 11:50 PM
Also, for the sake of trying and if you are in a position to do so, save you ASA configuration and then restart the ASA.
If that does not work, and you see traffic leaving the outside interface but see no return traffic in the packet capture, and you see no log relating to the traffic being dropped in the the realtime log viewer, I would ask your ISP to do a clear ARP for your IP (though I would not suspect you to be able to ping your ISP if this was an ARP issue). You might also want to ask them to flap the interface that goes to your ASA on their side (shut, no shut).
When pinging from the box there should be nothing preventing the ASA from receiving a reply, or nothing configured on the ASA that will prevent the reply with your current configuration. Meaning you have a default route configured and interface configurations seem to be correct.
--
Please remember to select a correct answer and rate helpful posts
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide