cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
5058
Views
0
Helpful
8
Replies

Nat can't ping internet

AgilepointIT
Level 1
Level 1

I'm new to Cisco ASA, looking for some help.  I am trying to configure Nat on a clean ASA 5505, but can't get it to work.  I ran the commands below. On the ASA I can ping the internet and inside vlan ip.  On my laptop I can ping the ASA inside vlan ip, but I can't ping the outside vlan ip.  From another network I can ping the ASA outside public ip.  Is there an access-list that denies inside from accessing outside?  Or am I missing something here. 

I am running version 8.4(3) and I erased the existing configuration.

ASA(config)# interface vlan 1

ASA(config-if)# ip address 10.0.0.1 255.255.255.0

ASA(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA(config-if)# ip address x.x.x.10 255.255.255.248

ASA(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA(config-if)# exit

ASA(config)# route outside 0.0.0.0 0.0.0.0 x.x.x.9

ASA(config)# interface ethernet0/0

ASA(config-if)# switchport access vlan 2

ASA(config-if)# no shutdown

ASA(config)# interface ethernet0/1

ASA(config-if)# no shutdown

ASA(config)# object network Inside-Lan

(config-network-object)# subnet 10.0.0.0 255.255.255.0

ASA(config-network-object)# Nat (inside,out) dynamic interface

8 Replies 8

varrao
Level 10
Level 10

Hi Dan,

You might just need to add this:

policy-map global-policy

  class inspection_default

    inspect icmp

This is to allow the return echo reply for the ping packets.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao

My laptop is not able to ping the internet also so I don't think it has anything to do with icmp.  But I will give it a try.

is your external if called out or outside?

Sent from Cisco Technical Support iPad App

Well if your laptop is connected on the inside interafce of the ASA, then definitely you would need to add an inspection for the icmp traffic.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao

c.spescha
Level 1
Level 1

yes, "the fixup protocol icmp" you need anyhow, assuming you don't have a permit icmp-reply ACL on your external interface.

Sent from Cisco Technical Support iPad App

The good thing is Nat is working and I can browse the internet, but ping is still not working after running the commands.

Here is my running config:

AP-ASA# show run

: Saved

:

ASA Version 8.4(3)

!

hostname AP-ASA

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address x.x.x.10 255.255.255.248

!

ftp mode passive

object network inside-net

subnet 10.0.0.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network inside-net

nat (inside,outside) dynamic interface

route outside 0.0.0.0 0.0.0.0 x.x.x.9 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:39f9cab0f162e574ef9929ca75036db4

: end

AP-ASA#

configure "fixup protocol icmp".

Sent from Cisco Technical Support iPad App

Hi,

I am not sure whether you have done it or not. If you are able to browse internet but not ping, then it is clearly a icmp echo reply issue, you would need to configure anyone of these two options:

Option 1:

policy-map global_policy

   class inspection_default

      inspect icmp

Option 2:

access-list outside_access_in permit icmp any any

access-group in interface outside

and you would see the pings working.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao
Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: