cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements

5743
Views
0
Helpful
20
Replies
badingdong
Beginner

Cisco ASA 5505 can ping gateway but can't ping internet

Good day to all!

Sorry if I post this on the wrong group, I am having a bit of a problem on configuring an ASA 5505 firewall. And I scoured google but can't seem to find a specific link to my issues.

It is on a routed mode, have successfully configured inside and outside vlans. Hosts inside vlan can ping each other. Hosts on outside vlan can also ping each other. Problem is, when I am pinging 8.8.8.8, I received ????? Please see config below.

Any help greatly appreciated.

TIA!

##################

 

: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasan
enable password bD3fGYMFeJJTATOJ encrypted
passwd 2KF1w9ErdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 description INSIDE
 nameif inside
 security-level 100
 ip address 10.10.10.2 255.255.255.0
!
interface Vlan2
 description OUTSIDE
 nameif outside
 security-level 0
 ip address 203.127.68.2 255.255.255.240
!
ftp mode passive
object network obj_any
 subnet 0.0.0.0 0.0.0.0
access-list outside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 203.127.68.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
http authentication-certificate inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh 10.10.10.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 anyconnect-essentials
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:6b3e0ce99eda3d2563cf9f392f8001b7
: end

 

20 REPLIES 20

Hi Marius, Thanks a lot on the pointers.. I was able to ping now 8.8.8.8 but what I did was I created a new vlan on port 0/1 of the asa and configured it identically to the outside vlan. Will try to reconfigure outside vlan to see what I missed.

Interesting...what would be interesting to see is if you moved VLAN 2 to Eth0/1...it could be that Eth0/0 is faulty.

If you are able to do so, set up Eth0/0 in the new outside VLAN and connect it to the ISP if it still doesn't work then that port is faulty

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts

I'll check it later to see if it is. Thanks!
 

weijun.duan
Beginner

 

 

add :access-list outside_access_in extended permit icmp any any

anassor1121
Beginner

Can you apply the following and see if it will work.

policy-map global_policy
 class inspection_default
  inspect icmp
  inspect icmp error

NikolaZg350
Beginner

turn on icmp inspection

Content for Community-Ad