Cisco ASA 5505 Ping outside and Internet access

[Test Man]

Hi There,

Am new to Cisco, getting used to the CLI first, have used ADSM a bit. I'm trying to configure this Firewall to allow pinging to outside and also to allow web access but I can't seem to figure out what's wrong, my running config is below, this 5505 is running a Base License.

Port 0 is connected to my main network(effectively the outside)

Any help is greatly appreciated.

ciscoasa# show run
: Saved
:
ASA Version 9.0(2)
!
hostname ciscoasa
enable password G.yIPR9fZr0irTlR encrypted
passwd G.yIPR9fZr0irTlR encrypted
names
!
interface Ethernet0/0
!
interface Ethernet0/1
 switchport access vlan 2
!
interface Ethernet0/2
 switchport access vlan 2
!
interface Ethernet0/3
 switchport access vlan 2
!
interface Ethernet0/4
 switchport access vlan 2
!
interface Ethernet0/5
 switchport access vlan 2
 shutdown
!
interface Ethernet0/6
 switchport access vlan 2
 shutdown
!
interface Ethernet0/7
 switchport access vlan 3
!
interface Vlan1
 management-only
 nameif Uplink
 security-level 0
 ip address dhcp setroute
!
interface Vlan2
 nameif Primary
 security-level 100
 ip address 192.168.10.1 255.255.255.0
!
interface Vlan3
 no forward interface Vlan2
 nameif Secondary
 security-level 100
 ip address 192.168.20.1 255.255.255.0
!
boot system disk0:/asa902-k8.bin
ftp mode passive
pager lines 24
mtu Uplink 1500
mtu Primary 1500
mtu Secondary 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-712.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 Uplink
http 192.168.10.0 255.255.255.0 Primary
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh 192.168.1.0 255.255.255.0 Uplink
ssh timeout 5
console timeout 0

dhcpd address 192.168.10.50-192.168.10.60 Primary
dhcpd enable Primary
!
dhcpd address 192.168.20.100-192.168.20.200 Secondary
dhcpd enable Secondary
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username kishan password kUxcvL6Wtxn1HJAO encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:c633636a9ed162d60e988e933b944608
: end

[Rahul Govindan]

Ethernet0/0 is set by default to "switchport access vlan 1". Your Vlan 1 interface is set to management-only, meaning it wont allow through the box traffic. Try removing that command from Vlan1.

Also, if you are pinging the outside network from the inside, you would need to inspect icmp on your way out, if you want to allow the return traffic to come back in without an explict ACL configure. Try adding "fixup protocol icmp" in the configure mode.

[Test Man]

I did the changes you mentioned but it still did not work, I took off the management-only on Vlan1 and allowed icmp and icmp error in the global map-policy but it still didn't work.

If I SSH onto the ASA, it can ping 8.8.8.8 but I don't know which interface it's doing it from, I'm assuming 0/0, however if I run packet-tracer with the source being 0/2 and dest being 0/0 it drops the pack on return I beleive as it say's there is no route to the host for some reason.

[Rahul Govindan]

Can you paste the packet-tracer output?

Also, you don't seem to have a default route for the outside interface, so any internet address wont be reachable. You would need to add something like this:

route Uplink 0 0 <Gateway_ip_address>

[Test Man]

Here's my packet-trace:

192.168.10.50 = laptop inside Primary(vlan 2)

192.168.1.32  = dhcp assigned ip of vlan 1

ciscoasa# packet-tracer input Primary icmp 192.168.10.50 8 0 192.168.1.32 detail

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.32    255.255.255.255 identity

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.32    255.255.255.255 identity

Result:
input-interface: Primary
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

ciscoasa# ping 192.168.1.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.1.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
ciscoasa# packet-tracer input Primary icmp 192.168.10.50 8 0 192.168.1.32 deta$

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.32    255.255.255.255 identity

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.1.32    255.255.255.255 identity

Result:
input-interface: Primary
input-status: up
input-line-status: up
output-interface: NP Identity Ifc
output-status: up
output-line-status: up
Action: drop
Drop-reason: (no-route) No route to host

This is my current route setup:

ciscoasa# show route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 192.168.1.1 to network 0.0.0.0

C    192.168.10.0 255.255.255.0 is directly connected, Primary
C    192.168.1.0 255.255.255.0 is directly connected, Uplink
d*   0.0.0.0 0.0.0.0 [1/0] via 192.168.1.1, Uplink

I tried adding a route Uplink 0 0 192.168.1.1 but it still did not work.

[Marvin Rhoads]

You cannot ping the uplink interface from any other interface or host connected via any other interface. That is by design how an ASA works. 

Make the destination of your packet-tracer 8.8.8.8 and you will the the egress interface confirmed. 

[Test Man]

Ah yes, making the packet tracer dest 8.8.8.8 worked, and thanks for info regarding pinging other interfaces on the ASA.

[Marius Gunnerud · Accepted solution]

In addition to other observations in this post, you also have no dynamic NAT configured.  Add the following also and test:

object network LOCAL_LAN

  subnet 192.168.10.0 255.255.255.0

  nat (Primary,Uplink) dynamic interface

--

Please remember to select a correct answer and rate helpful posts

[Test Man]

This worked !, I can now ping outside the firewall and receive replys, I'm trying to understand what the commands did. The "object network LOCAL_LAN", did that create a new network object ?, as when I typed "object network ?", it allows me to enter a word, so i'm not sure where LOCAL_LAN came from ?, or is the simply a given name and could be anything ?

Then the next 2 commads, are they saying for subnet XXXXX, do nat in this order dynamically ?

[Marius Gunnerud]

The "object network LOCAL_LAN", did that create a new network object ?

Yes this created a new network object. LOCAL_LAN is userdefined so you could replace this with whatever you like.  Once you create the object you need to define IPs, subnets, or a range of IPs that this object will reference.

So the subnet command and NAT command under the network object state that for the IP, subnet or range of IPs in this object, dynamically NAT this to the outside interface IP.  Now this is the configuration for auto-NAT or Section 2 NAT.  The same result could be achieved with the use of Manual NAT (Section 1) or After-Auto NAT (Section 3).  the configuration is different and the matching method is also different.  But in short Section 1 will be matched first, then entries in Section 2, and finally entries in Section 3.  Section 1 and 3 are based on a top down method (much like how ACLs are matched) and Section 2 is matched based on longest match.  That means that in section 2 if you have a 192.168.1.0/24 configured before 192.168.1.10/32, the /32.  Then if traffic from 192.168.1.10 will match /32 even though the /24 is configured above it.

Keep in mind that object network can only hold a single IP, subnet, or range entry.  If you want to group several IPs together you will need to use object-group network.

--

Please remember to select a correct answer and rate helpful posts

[LovejitSingh130013]

fixup protocol icmp was helpful, there was alternative fix to this as well?  Do you recall that ?

[Rob Ingram]

@LovejitSingh130013 Permit icmp echo-reply inbound on the outside ACL.

[LovejitSingh130013]

@Rob Ingram does these commands will do same thing

icmp permit any outside

icmp permit any inside

[Rob Ingram]

@LovejitSingh130013 

No, those commands are for icmp "to" the ASAs interfaces.

Configuring icmp inbound on the outside interface is for traffic "through" the ASA.

E.g. "access-list OUTSIDE_IN permit icmp any any echo-reply"