Nat can't ping internet

AgilepointIT · ‎06-18-2012

I'm new to Cisco ASA, looking for some help. I am trying to configure Nat on a clean ASA 5505, but can't get it to work. I ran the commands below. On the ASA I can ping the internet and inside vlan ip. On my laptop I can ping the ASA inside vlan ip, but I can't ping the outside vlan ip. From another network I can ping the ASA outside public ip. Is there an access-list that denies inside from accessing outside? Or am I missing something here.

I am running version 8.4(3) and I erased the existing configuration.

ASA(config)# interface vlan 1

ASA(config-if)# ip address 10.0.0.1 255.255.255.0

ASA(config-if)# nameif inside

INFO: Security level for "inside" set to 100 by default.

ASA(config-if)# ip address x.x.x.10 255.255.255.248

ASA(config-if)# nameif outside

INFO: Security level for "outside" set to 0 by default.

ASA(config-if)# exit

ASA(config)# route outside 0.0.0.0 0.0.0.0 x.x.x.9

ASA(config)# interface ethernet0/0

ASA(config-if)# switchport access vlan 2

ASA(config-if)# no shutdown

ASA(config)# interface ethernet0/1

ASA(config-if)# no shutdown

ASA(config)# object network Inside-Lan

(config-network-object)# subnet 10.0.0.0 255.255.255.0

ASA(config-network-object)# Nat (inside,out) dynamic interface

varrao · ‎06-18-2012

Hi Dan,

You might just need to add this:

policy-map global-policy

class inspection_default

inspect icmp

This is to allow the return echo reply for the ping packets.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao

AgilepointIT · ‎06-19-2012

My laptop is not able to ping the internet also so I don't think it has anything to do with icmp. But I will give it a try.

c.spescha · ‎06-19-2012

is your external if called out or outside?

Sent from Cisco Technical Support iPad App

varrao · ‎06-19-2012

Well if your laptop is connected on the inside interafce of the ASA, then definitely you would need to add an inspection for the icmp traffic.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao

c.spescha · ‎06-19-2012

yes, "the fixup protocol icmp" you need anyhow, assuming you don't have a permit icmp-reply ACL on your external interface.

Sent from Cisco Technical Support iPad App

AgilepointIT · ‎06-19-2012

The good thing is Nat is working and I can browse the internet, but ping is still not working after running the commands.

Here is my running config:

AP-ASA# show run

: Saved

:

ASA Version 8.4(3)

!

hostname AP-ASA

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

shutdown

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

shutdown

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address x.x.x.10 255.255.255.248

!

ftp mode passive

object network inside-net

subnet 10.0.0.0 255.255.255.0

pager lines 24

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network inside-net

nat (inside,outside) dynamic interface

route outside 0.0.0.0 0.0.0.0 x.x.x.9 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect ip-options

inspect netbios

inspect rsh

inspect rtsp

inspect skinny

inspect esmtp

inspect sqlnet

inspect sunrpc

inspect tftp

inspect sip

inspect xdmcp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

no active

destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

destination address email callhome@cisco.com

destination transport-method http

subscribe-to-alert-group diagnostic

subscribe-to-alert-group environment

subscribe-to-alert-group inventory periodic monthly

subscribe-to-alert-group configuration periodic monthly

subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:39f9cab0f162e574ef9929ca75036db4

: end

AP-ASA#

c.spescha · ‎06-19-2012

configure "fixup protocol icmp".

Sent from Cisco Technical Support iPad App

varrao · ‎06-19-2012

Hi,

I am not sure whether you have done it or not. If you are able to browse internet but not ping, then it is clearly a icmp echo reply issue, you would need to configure anyone of these two options:

Option 1:

policy-map global_policy

class inspection_default

inspect icmp

Option 2:

access-list outside_access_in permit icmp any any

access-group in interface outside

and you would see the pings working.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Thanks,
Varun Rao