Hello,
I'm a beginner in Cisco, and in ASA. My previous firewall was a Proliant DL380 running fwbuilder on opensuse. The server worked also as router, DHCP and DNS server of my domestic network.
I decide to switch to Cisco to reduce the count of running servers.
versions:
Cisco Adaptive Security Appliance Software Version 8.3(1)
Device Manager Version 6.4(7)
My first attempt to configure the ASA is based on a simple network (IMO):
- an inside network (192.168.2.0/24, gateway 192.168.2.1) connected with ip 192.168.2.1 on ethernet0/1 on the ASA (it works as gateway, and DHCP server)
- an outside network (192.168.0.0/24, gateway 192.168.0.200) connected to ethernet0/0 on the ASA (ip 192.168.0.19/24)
- a NAT (or PAT, or any equivalent name) allowing the hosts on 192.168.2.0 to reach 192.168.0.200. This host is currently (for my tests) a simple host).
- a management network (192.168.200.0/24), connected to the management interface (ip 192.168.200.1, DHCP server)
I tried the configuration pasted at the end of my post.
I tried to debug it with packet-tracer, since the NAT doesn't work: a host connected to ethernet0/0 (ip 192.168.2.2) is able to ping 192.168.2.1, but unable to ping 192.168.0.200. 192.168.0.200 is able to ping the ASA outside ip (192.168.0.19).
It doesn't find any problem.
Thanks for any help or hint
Best regards
asa5510# packet-tracer input inside icmp 192.168.2.2 8 0 192.168.0.200
Phase: 1
Type: ACCESS-LIST
Subtype:
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list
Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 192.168.0.0 255.255.255.0 outside
Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside_access_in in interface inside
access-list inside_access_in extended permit ip any any
Additional Information:
Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 5
Type: INSPECT
Subtype: np-inspect
Result: ALLOW
Config:
Additional Information:
Phase: 6
Type: NAT
Subtype:
Result: ALLOW
Config:
object network everybody
nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 192.168.2.2/0 to 192.168.0.19/11871
Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 4, packet dispatched to next module
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1599 MHz
Internal ATA Compact Flash, 256MB
BIOS Flash M50FW080 @ 0xfff00000, 1024KB
Encryption hardware device : Cisco ASA-55x0 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.06
0: Ext: Ethernet0/0 : address is 0023.5e25.3b26, irq 9
1: Ext: Ethernet0/1 : address is 0023.5e25.3b27, irq 9
2: Ext: Ethernet0/2 : address is 0023.5e25.3b28, irq 9
3: Ext: Ethernet0/3 : address is 0023.5e25.3b29, irq 9
4: Ext: Management0/0 : address is 0023.5e25.3b25, irq 11
5: Int: Not used : irq 11
6: Int: Not used : irq 5
Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 50 perpetual
Inside Hosts : Unlimited perpetual
Failover : Disabled perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
Security Contexts : 0 perpetual
GTP/GPRS : Disabled perpetual
SSL VPN Peers : 2 perpetual
Total VPN Peers : 250 perpetual
Shared License : Disabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
AnyConnect Essentials : Disabled perpetual
Advanced Endpoint Assessment : Disabled perpetual
UC Phone Proxy Sessions : 2 perpetual
Total UC Proxy Sessions : 2 perpetual
Botnet Traffic Filter : Disabled perpetual
Intercompany Media Engine : Disabled perpetual
This platform has a Base license.
Configuration register is 0x1
Configuration has not been modified since last system restart.
asa5510# show config
: Saved
: Written by enable_15 at 00:40:37.519 UTC Wed Jan 1 2003
!
ASA Version 8.3(1)
!
hostname asa5510
domain-name XXXXXXXXX
enable password XXXXXXXXXX
passwd XXXXXXXXX
names
!
interface Ethernet0/0
nameif outside
security-level 20
ip address 192.168.0.19 255.255.255.0
!
interface Ethernet0/1
nameif inside
security-level 100
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 80
ip address 192.168.200.1 255.255.255.0
!
ftp mode passive
dns server-group DefaultDNS
domain-name XXXXXXXXX
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network everybody
subnet 0.0.0.0 0.0.0.0
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit icmp any any
access-list management_access_in extended permit ip any any
access-list management_access_in extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-647.bin
no asdm history enable
arp timeout 14400
!
object network everybody
nat (inside,outside) dynamic interface
access-group inside_access_in in interface inside
access-group management_access_in in interface management
route outside 0.0.0.0 0.0.0.0 192.168.0.200 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.200.1 255.255.255.255 inside
http 192.168.200.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.2.2-192.168.2.254 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
dhcpd address 192.168.200.2-192.168.200.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DD CEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
