Just can't get routing to work.

[dclarolh1]

I must be missing something cause I did this tons of times.

Here is my config:

ASA Version 8.2(2)19
!
hostname ***********
enable password ds4hdW4uvMnfKnfo encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.245.254.2 255.255.255.0
!
interface Ethernet0/1
nameif Outside2
security-level 100
no ip address
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.245.1.1 255.255.255.0
!
interface Ethernet0/3
shutdown
nameif Inside2
security-level 100
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/disk0:/asa822-19-k8.bin
boot system disk0:/asa822-19-k8.bin
ftp mode passive
pager lines 24
logging asdm informational
mtu outside 1500
mtu Outside2 1500
mtu inside 1500
mtu Inside2 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-632.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (management) 101 0.0.0.0 0.0.0.0
route outside 0.0.0.0 0.0.0.0 10.245.254.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:0
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.10-192.168.1.15 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/servicCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:76311b3a2af33a4fa142368bc959c806
: end

Thanks.

[Federico Coto Fajardo]

Hi,

You posted the ASA configuration.

What's the problem?

Can't get routing to work does not tell us much...

Federico.

[dclarolh1]

You're right.

So here's the explanation.

there is another router physically connected to int e0/0. That router is 10.245.254.1.

From the asa I can ping it since it's directly connected, but from a computer connected to the inside interface e0/2 (10.245.1.1) I can not ping the outside interface of the asa and thats as far as it gets. It doesn't even get to the other router.

The computer is configured with 10.245.1.2 255.255.255.0.

[dclarolh1]

Here is the updated config after I made some access-list changes.

ASA Version 8.2(2)19
!
hostname ***************
enable password ds4hdW4uvMnfKnfo encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.245.254.2 255.255.255.0
!
interface Ethernet0/1
shutdown
nameif Outside2
security-level 100
no ip address
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.245.1.1 255.255.255.0
!
interface Ethernet0/3
shutdown
nameif Inside2
security-level 100
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa822-19-k8.bin
ftp mode passive
access-list traffic extended permit ip any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu Outside2 1500
mtu inside 1500
mtu Inside2 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-632.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (management) 101 0.0.0.0 0.0.0.0
access-group traffic in interface inside
route outside 0.0.0.0 0.0.0.0 10.245.254.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.10-192.168.1.15 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:86a112e59c1779868fd5e3aa41f8a1a4
: end

[Jon Marshall]

Your problem is the router does not have a route back to the 10.245.1.0/24 network. Your NAT configuration is not natting the inside addresses as they go to the outside ie. -

global (outside) 101 interface
nat (inside) 1 0.0.0.0 0.0.0.0

so you have 2 solutions -

1) either add a route to the router for the 10.245.1.0/24 network ie.

ip route 10.245.1.0 255.255.255.0 10.245.254.2

or a better choice unless you really don't want to NAT the inside addresses is to add this to your ASA config -

global (outside) 1 interface

Edit - and also what Giuseppe says ie. you need to allow ICMP as well either by an access-list on the outside interface or by turning on ICMP inspection.

Jon

[dclarolh1]

It says:

global for this range already exists

when I try to do:

global (outside) 1 interface

because I already have:

global (outside) 101 interface

and the asa doesn't take that IP route command. it has to be "route interfacename x.x.x.x x.x.x.x x.x.x.x".

[Jon Marshall · Accepted solution]

mundusrector wrote:
It says:
global for this range already exists
when I try to do:
global (outside) 1 interface
because I already have:
global (outside) 101 interface
and the asa doesn't take that IP route command. it has to be "route interfacename x.x.x.x x.x.x.x x.x.x.x".

The route command is not added to the ASA it is added to the router.

If you can't enter the global command then do this -

nat (inside) 101 0.0.0.0 0.0.0.0

You only need to do one of the above.

An access-list with permit ip any any on the outside interface will indeed allow ICMP back through - just didn't see it in the config, my mistake. Note though that you applied it to the wrong interface ie. you have

access-group traffic in interface inside

whereas it should be -

access-group traffic in interface outside

Jon

[dclarolh1]

All that and still not luck, here is where the config stands:

ASA Version 8.2(2)19
!
hostname ***********
enable password ds4hdW4uvMnfKnfo encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address 10.245.254.2 255.255.255.0
!
interface Ethernet0/1
shutdown
nameif Outside2
security-level 100
no ip address
!
interface Ethernet0/2
nameif inside
security-level 100
ip address 10.245.253.1 255.255.255.0
!
interface Ethernet0/3
shutdown
nameif Inside2
security-level 100
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
boot system disk0:/asa822-19-k8.bin
ftp mode passive
access-list traffic extended permit ip any any
pager lines 24
logging asdm informational
mtu outside 1500
mtu Outside2 1500
mtu inside 1500
mtu Inside2 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-632.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0
nat (management) 101 0.0.0.0 0.0.0.0
access-group traffic in interface outside
route outside 0.0.0.0 0.0.0.0 10.245.254.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto isakmp policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.10-192.168.1.15 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:9acac0aa9eb934a7b577ea5b7db8f290
: end

[Nagaraja Thanthry]

Hello,

First of all, you cannot ping the ASA outside interface from the inside subnet. You should try to ping the router. Your configuration looks fine exept the ICMP related configurations. Please add the following line and you should be able to ping the Router:

icmp permit any outside

Now, this does not prevent you from sending TCP/UDP traffic to the router. You can try to telnet to the router (if it is enabled) without the above line and should be able to get responses.

Hope this helps.

Regards,

NT

[Giuseppe Larosa]

Hello Mundusrector,

>> From the asa I can ping it since it's directly connected, but from a computer connected to the inside interface e0/2 (10.245.1.1) I can not ping the outside interface of the asa and thats as far as it gets. It doesn't even get to the other router.

This is expected as the ASA is a firewall and not a router, this is one of the basic differences between  a stateful firewall and a router.

Unless you add specific commands to allow ICMP ( like permitting it on ACLs or other commands for example) this is not allowed

Hope to help

Giuseppe

[dclarolh1]

doesn't this take care of that?

access-list traffic extended permit ip any any