Stuck at work

[Shawn.gaston1]

Guys I have a Cisco asa 5505. It has been working perfectly fine until round 5pm yesterday evening when i got the call the internet was down at this office. i logged in to start to troubleshooting the issue and looked. nothing supposed changed on the firewall  I looked and didnt see anything either. so i called the isp no issues. even verified by plugging a laptop directly into the external and testing works fine. I'm stumped as i can test the ping from the asa no issues inbound or out bound. attached the config if any way could tell em anything that looks like would stop it. again i apologize for my ignorance as trying to learn as much on asa's as possible.

!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.30.5.2 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 72.64.148.113 255.255.255.0 
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
 domain-name 
object network obj_any 
 subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_10.10.0.0_24 
 subnet 10.10.0.0 255.255.255.0
object network 10.10.11.0_24 
 subnet 10.10.11.0 255.255.255.0
object network 10.10.12.0_24 
 subnet 10.10.12.0 255.255.255.0
object network 10.10.13.0_24 
 subnet 10.10.13.0 255.255.255.0
object network 10.10.96.0_24 
 subnet 10.10.96.0 255.255.255.0
object network 10.2.0.0_24 
 subnet 10.2.0.0 255.255.255.0
object network 10.3.0.0_24 
 subnet 10.3.0.0 255.255.255.0
object network 10.30.1.0 
 subnet 10.30.1.0 255.255.255.0
object network 10.10.51.0 
 subnet 10.10.51.0 255.255.255.0
object network 10.5.0.0 
 subnet 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_1
 network-object 10.10.51.0 255.255.255.0
 network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
 network-object 10.10.51.0 255.255.255.0
 network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_3
 network-object 10.10.82.0 255.255.255.0
 network-object 10.10.85.0 255.255.255.0
object-group network DM_INLINE_NETWORK_4
 network-object 10.10.51.0 255.255.255.0
 network-object 10.5.0.0 255.255.255.0
object-group network Oak_New
 network-object object 10.10.11.0_24
 network-object object 10.10.12.0_24
 network-object object 10.10.13.0_24
 network-object object 10.10.96.0_24
 network-object object 10.2.0.0_24
 network-object object 10.3.0.0_24
object-group network DM_INLINE_NETWORK_5
 network-object 10.10.51.0 255.255.255.0
 network-object 10.5.0.0 255.255.255.0
object-group network DM_INLINE_NETWORK_6
 network-object 10.5.0.0 255.255.255.0
 network-object object 10.10.51.0
object-group network DM_INLINE_NETWORK_7
 network-object object 10.10.51.0
 network-object object 10.5.0.0
access-list outside_access_in extended permit icmp any any time-exceeded 
access-list outside_access_in extended permit icmp any any unreachable 
access-list outside_access_in extended permit icmp any any echo-reply 
access-list outside_1_cryptomap extended permit ip object-group DM_INLINE_NETWORK_1 10.10.0.0 255.255.255.0 
access-list outside_2_cryptomap extended permit ip object-group DM_INLINE_NETWORK_2 object-group DM_INLINE_NETWORK_3 
access-list outside_3_cryptomap extended permit ip object-group DM_INLINE_NETWORK_4 object-group Oak_New 
access-list outside_cryptomap extended permit ip object-group DM_INLINE_NETWORK_5 object-group Oak_New 
access-list outside_cryptomap_1 extended permit ip object-group DM_INLINE_NETWORK_6 object 10.30.1.0 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (inside,outside) source static DM_INLINE_NETWORK_7 DM_INLINE_NETWORK_7 destination static 10.30.1.0 10.30.1.0
nat (inside,outside) source static DM_INLINE_NETWORK_4 DM_INLINE_NETWORK_4 destination static Oak_New Oak_New
nat (inside,outside) source static DM_INLINE_NETWORK_1 DM_INLINE_NETWORK_1 destination static NETWORK_OBJ_10.10.0.0_24 NETWORK_OBJ_10.10.0.0_24
nat (inside,outside) source static DM_INLINE_NETWORK_2 DM_INLINE_NETWORK_2 destination static DM_INLINE_NETWORK_3 DM_INLINE_NETWORK_3
!
object network obj_any
 nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 72.64.148.1 1
route inside 10.5.0.0 255.255.255.0 10.30.5.1 1
route inside 10.10.51.0 255.255.255.0 10.30.5.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 inside
http 50.199.101.249 255.255.255.255 outside
http 10.10.51.0 255.255.255.0 inside
http 10.30.5.0 255.255.255.0 inside
http 66.194.205.54 255.255.255.255 outside
no snmp-server location
no snmp-server contact
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac 
crypto ipsec transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac 
crypto ipsec transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac 
crypto ipsec transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac 
crypto ipsec transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs 
crypto map outside_map 1 set peer 66.194.205.54 
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 2 match address outside_2_cryptomap
crypto map outside_map 2 set pfs group1
crypto map outside_map 2 set peer 50.199.101.249 
crypto map outside_map 2 set transform-set ESP-3DES-SHA
crypto map outside_map 3 match address outside_3_cryptomap
crypto map outside_map 3 set peer 50.192.34.253 
crypto map outside_map 3 set transform-set ESP-AES-128-SHA
crypto map outside_map 4 match address outside_cryptomap
crypto map outside_map 4 set peer 50.192.34.253 
crypto map outside_map 4 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 5 match address outside_cryptomap_1
crypto map outside_map 5 set peer 50.79.225.66 
crypto map outside_map 5 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 30
 authentication pre-share
 encryption aes
 hash sha
 group 5
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy GroupPolicy1 internal
group-policy GroupPolicy1 attributes
 vpn-tunnel-protocol IPSec 
username dkraut password 6iNmW1JnA8NEZk4S encrypted privilege 15
tunnel-group 66.194.205.54 type ipsec-l2l
tunnel-group 66.194.205.54 ipsec-attributes
 pre-shared-key *****
tunnel-group 50.199.101.249 type ipsec-l2l
tunnel-group 50.199.101.249 ipsec-attributes
 pre-shared-key *****
tunnel-group Oak type ipsec-l2l
tunnel-group Oak ipsec-attributes
 pre-shared-key *****
tunnel-group 50.192.34.253 type ipsec-l2l
tunnel-group 50.192.34.253 general-attributes
 default-group-policy GroupPolicy1
tunnel-group 50.192.34.253 ipsec-attributes
 pre-shared-key *****
tunnel-group 50.79.225.66 type ipsec-l2l
tunnel-group 50.79.225.66 general-attributes
 default-group-policy GroupPolicy1
tunnel-group 50.79.225.66 ipsec-attributes
 pre-shared-key *****
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect pptp 
!
service-policy global_policy global
prompt hostname context 
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
hpm topN enable
Cryptochecksum:08ba45188992f77e9f9105aa46772839
: end

[Jouni Forss]

Hi,

Does everyone on the LAN have the problem? Can anyone connect to the Internet?

Your post seems to indicate that the ASA has normal connectivity through the WAN link to the Internet.

I guess next I would take one example host from the LAN for which connection dont work and step by step go through the situation.

For example

• Check where the host tries to connect. I would imagine its always using a name that the host queries from the DNS server. If you have a local server acting as DNS server I would confirm that its able to provide the host with the IP address to its DNS queries. On a computer running Windows you could use the Start Menu -> Run -> nslookup and then write the destination DNS name to which the host tries to connect to determine if the host gets a DNS reply.
• If the DNS portion is fine then I would confirm that the connectivity from the host to the firewall is fine. There are naturally multiple ways. You could ping the interface IP address of the ASA behind which the host is. If there is no reply then look through ASDM logs if you can see anything of the ICMP there.
• You can naturally just try to connect with the host to the Internet and at the same time monitor the connection attempts through ASDM from this single host.
• If you can't even see connection attempts on the firewall then I would turn my eye on the LAN networks devices. It seems you have an internal router since the ASA has routes towards some internal IP address. Make sure all the devices on the LAN are ok and have connectivity. Make sure that no changes have been made to them.

- Jouni

[Shawn.gaston1]

Jouni I finally got it fixed. it was a nat issue. but why it changed I don't know. one thing is can you explain to me why I had to put the any any inside outside nat rule below any static nats for this to work? I don't really understand that part but as soon as I did that all came up fine. thanks for all your help again.