No Internet Access but connected to domain. New install of Windows 7

KYLE NGUYEN · ‎09-07-2016

Hi everyone

I have a problem that's driving me nuts trying to troubleshoot. Brand new install of Windows 7 Dell latitude. I'm connected to our domain, but cannot browse the Internet with exclamation icon and msg "No Internet Access."

I can ping all internal servers and gateway. No issues there.

I took the laptop home and connected to my home network fine. Internet connection works perfectly.

But when I get back to the office, I tried connecting with both wired and wireless, both gives msg "No Internet Access."

Firewall is ASA 5505. I did some googling, and found some info on IP Shunning, but when I check my firewall settings, shunning is not enabled.

Any help is greatly appreciated. Thanks.

Marvin Rhoads · ‎09-07-2016

Are all of your network settings (IP address, DNS and domain name) set to "auto"?

When you have the failed connectivity, check "ipconfig /all" to see that you are getting everything you expect.

If that looks good, then check the firewall. First make sure traffic from your PC is reaching it (packet capture is easiest). Then make sure it is getting passed through and NATted like you expect (packet-tracer tool)

KYLE NGUYEN · ‎09-08-2016

Hi,

yes. ipconfig /all shows all the right ip addresses.

I not all that familiar with ASA firewalls, so if you can walk me through setting up the packet capture I would really appreciate it.

Some new developments. so I connected the new laptop directly to the ASA firewall and I get an Internet Connection immediately. I can ping all internal servers and browse the internet.

If I plug it back into the Cisco switch I lose internet connection, but I'm still connected to the domain/network.

I tried setting up another new desktop and I'm getting the exact same issue. No Internet Access, but I can join domain and connect to all internal servers.

All other workstation already on the network is functioning like normal. No problems. It's only affecting any new machines I'm connecting to the network.

Any idea what's going on?

Marvin Rhoads · ‎09-08-2016

Here's how to do a packet trace on an ASA:

packet-tracer input inside tcp <your pc address> 1025 8.8.8.8 80

That injects a dummy packet to the ASA's inside interface from your client's address using a random ephemeral tcp port as the source with a destination of an Internet address on port 80. (It doesn't matter whether or not anything at that address is listening on port 80 - we only care if the packet leaves the ASA.)

You can do the same thing from the ASDM GUI (Tools > Packet tracer)

If that command tells you at the end the packet is "ALLOWED", then your traffic is probably not reaching the ASA. To verify that, use the packet capture wizard (Wizards > Packet Capture Wizard) to look for the traffic incoming from your PC's source address.

KYLE NGUYEN · ‎09-08-2016

I ran the packet-tracer and the packet was "Allowed."

I'm pretty sure the traffic is not reaching the ASA for some reason.

I just don't understand why all other workstations are working fine, but it's blocking traffic to ASA on all new computers I add to the network. Why are some traffic reaching the ASA and some not? strange.

Marvin Rhoads · ‎09-08-2016

It could be any number of things. Port security on your switch, an ACL in your core, a subnet mask mismatch somewhere, asymmetric routing etc.

Break it down step by step. See if you can reach the core switch from your new PC. Then the ASA. Don't just use ping, use something that requires a 3-way handshake like telnet

KYLE NGUYEN · ‎09-08-2016

Ok I can telnet into the core switch fine.

Telnet into ASA does not work. No connection.

Marvin Rhoads · ‎09-08-2016

We normally disable telnet on the ASA.

Make sure your source address / subnet is allowed in the ASA configuration (something like "ssh inside 0.0.0.0 0.0.0.0") and try ssh instead.

KYLE NGUYEN · ‎09-08-2016

Don't think it's disabled, because I can telnet into the ASA from my computer fine.

It's just doesn't work from all new computers.

Marvin Rhoads · ‎09-08-2016

Check the packet capture I noted earlier to see if the traffic is arriving at the AS inside interface.

KYLE NGUYEN · ‎09-08-2016

Can you walk me through the Packet Capture Wizard?

Point of Ingress

Packet match criteria > do i choose specify packet parameters?

Then put in the source host and destination, protocol is IP?

Point of Egress

input same parameters from point of ingress?

Marvin Rhoads · ‎09-08-2016

Point of ingress is Inside interface.

Match on your new PC source IP and netmask (255.255.255.255), protocol IP.

Egress leave it as any (0.0.0.0 0.0.0.0) since you don't care - you are just seeing if the packets arrive.

KYLE NGUYEN · ‎09-08-2016

Here's what I got from the problematic ip address. So that means packets are hitting the ASA?

136 p

ackets captured