Please help me configure ASA5506-x

[hyjeon]

Hello,

I recently bought a used Cisco ASA5506-x for training purpose. I spent hours exploring on Google but I haven't figured out how to make it work.

ISP : DHCP

GI 1/1 : WAN

GI 2-5 : 192.168.0.2-192.168.0.100

Default Gateway : 192.168.0.1

I can ping to outside on gi1/1 but I do not know how to make internal IPs(192.168.0.x) go through GI1/1 to the internet.

please see my config below.

Thanks very very much in advance for your help.

ASA Version 9.3(2)2
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif management
security-level 100
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (any,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
route outside 0.0.0.0 0.0.0.0 192.168.10.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.0.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 168.126.63.1 168.126.63.2
dhcpd auto_config outside
!
dhcpd address 192.168.0.2-192.168.0.10 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:e833f00ad1a200e8dd02c1f3fb7d7c93
: end

[hyjeon]

Rick. the internet is working. the thing didn't work was ICMP not the internet. I just tested ping but got request timeout so I thought it wasn't working. I "accidentally" opened the i.e and noticed it worked!

Thanks very much for your advice!

[Richard Burts]

Thanks for the update. So access to Internet is working? That is good news.

[hyjeon]

So in summary,

if my ISP router provides DHCP. all I need to do is

GI1/1

nameif outside

ip address dhcp setroute

no shut

GI1/2

nameif inside

ip address 192.168.0.1 255.255.255.0

dhcpd address 192.168.0.2-192.168.0.254 inside

dhcpd enable inside

Please correct me if I'm wrong.

[Georg Pauwen]

Hello,

correct. That should do it. 

[hyjeon]

Georg,

I have a quick question.

I enabled the GI1/3

nameif Office

ip address 192.168.3.1 255.255.255.0

no shut

dhcpd address 192.168.3.2-192.168.3.254 Office

dhcpd enable Office

I get an IP:192.168.3.5 when I connect a lan cable from gi1/3 to my laptop but the internet is not working.(I of course checked with my web browser but it doesn't work..)

In this case how to make gi1/3 access to internet?

[Richard Burts]

There are perhaps several things that could be involved. I started to identify address translation as an important step. But that is covered in the config that you posted. Are these commands still in the config

object network obj_any
nat (any,outside) dynamic interface

if so then they should provide translation for the new addresses. What security level did you assign to the interface?

Does the laptop have an entry in its arp table for the new ASA interface?

If you attempt to access Internet resources from the laptop and then look in the log file of the ASA are there any log messages about that attempt?

[hyjeon]

Aww. I'm very sorry. the internet is working. I just run ping to 8.8.8.8 and got request timeout so I thought the internet was working but I just found I could access the internet with a web browser. 

[hyjeon]

Hi Georg,

Here'e the gi1/2 status

ciscoasa(config)# show int gi1/2
Interface GigabitEthernet1/2 "inside", is up, line protocol is up
Hardware is Accelerator rev01, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Input flow control is unsupported, output flow control is off
MAC address b0aa.777c.a9f5, MTU 1500
IP address 192.168.0.1, subnet mask 255.255.255.0
174999 packets input, 34036737 bytes, 0 no buffer
Received 3601 broadcasts, 0 runts, 0 giants
0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort
0 pause input, 0 resume input
0 L2 decode drops
242032 packets output, 2527150346167 bytes, 0 underruns
0 pause output, 0 resume output
0 output errors, 0 collisions, 0 interface resets
0 late collisions, 0 deferred
0 input reset drops, 18 output reset drops
input queue (blocks free curr/low): hardware (913/890)
output queue (blocks free curr/low): hardware (1023/996)
Traffic Statistics for "inside":
174884 packets input, 30441809 bytes
242032 packets output, 124759881 bytes
8604 packets dropped
1 minute input rate 0 pkts/sec, 0 bytes/sec
1 minute output rate 0 pkts/sec, 0 bytes/sec
1 minute drop rate, 0 pkts/sec
5 minute input rate 0 pkts/sec, 0 bytes/sec
5 minute output rate 0 pkts/sec, 0 bytes/sec
5 minute drop rate, 0 pkts/sec

[hyjeon]

it works now Georg. the thing that wasn't working was just icmp not the internet. I opened the ie and it worked!

[Georg Pauwen]

Hello,

for the ICMP to work, you probably need to add the below to your global_policy:

policy-map global_policy
class inspection_default

--> inspect icmp

[hyjeon]

Hi Georg,

now it works.. thanks very very much!