Relocated ASA 5510; No Internet Access

[GreenT]

Hello,

we relocated our Asa 5510 to a new office location and were given a new static IP and router from Comcast. I changed all of the previous rules and interfaces in the ASDM to match the new static IP that was given to us. I can see all of our servers connected to the ASA however, none of the servers or PC’s have internet access when running through the firewall. I’m pretty new to ASA configurations and this ASA was pre configured when I joined the company. My guess is that I have an incorrect NAT or rule in place. 

Any help or guidance would be appreciated, thank you in advance!

[Rob Ingram]

@GreenT you'd need to change the IP address of the outside interface using the IP address provided by the provided and the default route to specify the next hop IP address of the comcast router.

You may only need to change the NAT rules if the traffic is translated to a specific public IP address. If it's translated to the outside interface, it should work once the IP address of the outside interface is changed.

From the ASA CLI can you ping the IP address of the comcast router? This is the next hop IP address.

Provide your configuration if you still need further assistance.

[GreenT]

@Rob Ingram  thanks for the response. I am able to ping the static IP that our ISP provided which is 50.215.xxx.xxx from the ASA CLI. They also provided a primary DNS but we already have our own DNS servers so would that given DNS be necessary? Here are the config settings we have on our ASA.

hostname ciscoasa5510
domain-name example.net
enable password f6SQg2V2aPgS.klT encrypted
passwd qNTzo6C1o9k7lk8f encrypted
names
name 66.184.xxx.xx pws_nlb_outside
name 10.126.xxx.xxbs1
name 192.168.xxx.xxx DMZ_Management
name 192.168.xxx.xxx pws_nlb
name 192.168.xxx.xxx pws3
name 10.126.xxx.xxx dev
name 192.168.xxx.xxx pws4
name 192.168.xxx.xxx pws4_nlb
name 192.168.xxx.xxxpws5
name 192.168.xxx.xxx pws5_nlb
name 172.24.xxx.xxx RackSpace1
name 172.24.xxx.xxx RackSpace2
name 10.176.xxx.xxxRackSpace4
name 10.208.xxx.xxxRackSpace5
name 172.24.xxx.xxx Rackspace3
name 10.126.xxx.xxx pms
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 50.215.xxx.xxx 255.255.255.252
!
interface Ethernet0/1
nameif inside-data
security-level 100
ip address 10.126.xx.x 255.255.255.0
!
interface Ethernet0/2
shutdown
nameif inside
security-level 100
no ip address
!
interface Ethernet0/3
nameif DMZ_Management
security-level 50
ip address 192.168.xx.x 255.255.255.192
!
interface Ethernet0/3.2
vlan 2
nameif DMZ_Wireless
security-level 25
ip address 192.168.x.xx 255.255.255.192
!
interface Ethernet0/3.3
vlan 3
nameif DMZ_Data
security-level 50
ip address 192.168.x.xxx 255.255.255.192
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.xx.xx 255.255.255.0
management-only
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns domain-lookup inside-data
dns domain-lookup inside
dns domain-lookup DMZ_Management
dns domain-lookup management
dns server-group DefaultDNS
name-server 75.75.75.75
name-server 75.75.76.76
domain-name example.net
same-security-traffic permit inter-interface
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
port-object eq 5090
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
object-group service RTP udp
port-object range 9000 9049
object-group service DM_INLINE_SERVICE_1
service-object tcp-udp eq www
service-object tcp eq https
object-group service RDP tcp
port-object eq 3389
object-group service Tunnel
service-object tcp eq 5090
object-group service Tunnel_3CX tcp-udp
port-object eq 5090
object-group network RackSpace
network-object Rackspace3 255.255.255.0
network-object RackSpace4 255.240.0.0
network-object RackSpace5 255.240.0.0
network-object RackSpace1 255.255.252.0
network-object RackSpace2 255.255.252.0
object-group network dns-server
access-list inside-data_nat0_outbound extended permit ip any 10.126.xx.x 255.255.255.0
access-list inside-data_nat0_outbound extended permit ip 10.126.xx.x255.255.255.0 DMZ_Management 255.255.255.192
access-list inside-data_nat0_outbound extended permit ip 10.126.xx.x 255.255.255.0 192.168.0.192 255.255.255.192
access-list inside-data_nat0_outbound extended permit ip 10.126.xx.x 255.255.255.0 object-group RackSpace
access-list outside_access_in extended permit tcp any host pws_nlb_outside object-group DM_INLINE_TCP_1
access-list outside_access_in extended permit tcp any 10.126.xx.x 255.255.255.0 object-group RDP
access-list outside_access_in extended permit icmp any any
access-list dmz_access_in extended permit ip any any
access-list dmz_access_in_1 extended permit ip any any
access-list outside_access_out extended permit ip any any
access-list inside-data_access_in extended permit ip any any
access-list DMZ_Data_access_in extended permit object-group DM_INLINE_SERVICE_1 any any
access-list DMZ_Data_access_in extended permit tcp host pws_nlb host dbs1 eq 3306
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws3 any eq domain
access-list DMZ_Data_access_in extended permit tcp host pws3 host dev eq 3306
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws4 any eq domain
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws4_nlb any eq domain
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws4_nlb host dbs1 eq 3306
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws5 any eq domain
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws5_nlb any eq domain
access-list DMZ_Data_access_in extended permit object-group TCPUDP host pws5_nlb host dbs1 eq 3306
access-list outside_cryptomap_65535.65535 extended permit ip any 10.126.xx.x 255.255.255.0
access-list outside_cryptomap extended permit ip 10.126.xx.x 255.255.255.0 object-group RackSpace
access-list inside-data_nat_outbound extended permit ip any any
pager lines 24
logging enable
logging timestamp
logging asdm warnings
mtu outside 1500
mtu inside-data 1500
mtu inside 1500
mtu DMZ_Management 1500
mtu DMZ_Wireless 1500
mtu DMZ_Data 1500
mtu management 1500
ip local pool SourceANYvpn 10.0.0.10-10.0.0.20 mask 255.255.255.0
ip local pool NewVPNpool 10.126.70.190-10.126.70.199 mask 255.255.255.0
ip local pool VPN_USER_POOL 10.126.70.210-10.126.70.254 mask 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface DMZ_Management
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside-data
no asdm history enable
arp timeout 14400
nat-control
global (outside) 1 interface
nat (inside-data) 0 access-list inside-data_nat0_outbound
nat (inside-data) 1 access-list inside-data_nat_outbound
nat (inside) 1 0.0.0.0 0.0.0.0
nat (DMZ_Wireless) 1 0.0.0.0 0.0.0.0
nat (DMZ_Data) 1 0.0.0.0 0.0.0.0
static (DMZ_Data,outside) tcp interface https pws_nlb https netmask 255.255.255.255
static (DMZ_Data,outside) tcp interface www pws_nlb www netmask 255.255.255.255
access-group outside_access_in in interface outside
access-group outside_access_out out interface outside
access-group inside-data_access_in in interface inside-data
access-group dmz_access_in_1 in interface DMZ_Management
access-group DMZ_Data_access_in in interface DMZ_Data
route outside 0.0.0.0 0.0.0.0 50.215.197.130 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.x.x 255.255.255.0 management
http 10.126.xx.x 255.255.255.0 inside-data

Let me know if you need anything else. Thank you again.

[MHM Cisco World]

I check you config there is no dynamic NAT 
NAT (inside,outside) dynamic interface  <<- please use the interface nameif as you enter in your config 

[GreenT]

@MHM Cisco World what's the command for that? Sorry a lot of this is new to me and I can get to some commands but when I try to configure the NAT (inside,outside) dynamic interface it gives me invalid input detected. I tried replacing with the name of the whatif interface and same error. Clearly I don't know how these commands work.

[MHM Cisco World]

I think you run ASA ver. older than 8.2 ? 

[GreenT]

ASA version 8.2(5)

[MHM Cisco World]

global (outside) 1 interface <<- I think this what you need 

Cisco_NAT_Cheat_Sheet.pdf (adldata.org)

[GreenT]

@MHM Cisco World  thank you! I'll get familiar with this and implement it when I return to the office on Monday.

[Marvin Rhoads]

Aside from the good advice provided by @MHM Cisco World and @Rob Ingram , you really need to convince management to get a new firewall. Your ASA 5510 is long past end of life and not what you should be relying on for effective protection in the modern threat landscape. Something like the Firepower 1010 or 1120 appliance running FTD image would be much better.

[GreenT]

@Marvin Rhoadsthanks for your response. Yes, I know the 5510 is EOL. I've explained that to my boss but it's not a high priority for the company at the moment. Unfortunately, this is what I am working with and they just want to be running ASAP. Hopefully later down the road they will upgrade and allow me to configure the new firewall so I can learn and get familiar with it.

[GreenT · Accepted solution]

I was able to figure out the issue. Comcast was able to transfer our old static IP over to our new office fortunately, after they did that I restored our firewall from the backup I made prior to the move and viola! Internet worked. One thing I know I had wrong was I plugged the internet/ethernet line from the router into the SSM module on the ASA so that was dumb of me but lesson learned. I learned a lot from this and thank you all for the help! I greatly appreciate you all!