Please help me configure ASA5506-x

[hyjeon]

Hello,

I recently bought a used Cisco ASA5506-x for training purpose. I spent hours exploring on Google but I haven't figured out how to make it work.

ISP : DHCP

GI 1/1 : WAN

GI 2-5 : 192.168.0.2-192.168.0.100

Default Gateway : 192.168.0.1

I can ping to outside on gi1/1 but I do not know how to make internal IPs(192.168.0.x) go through GI1/1 to the internet.

please see my config below.

Thanks very very much in advance for your help.

ASA Version 9.3(2)2
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.0.1 255.255.255.0
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
nameif management
security-level 100
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (any,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
route outside 0.0.0.0 0.0.0.0 192.168.10.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
http 192.168.0.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 168.126.63.1 168.126.63.2
dhcpd auto_config outside
!
dhcpd address 192.168.0.2-192.168.0.10 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:e833f00ad1a200e8dd02c1f3fb7d7c93
: end

[Georg Pauwen]

Hello,

does the ASA outside interface get an IP address (and if so, which one) ?

The interface command 'ip address dhcp setroute' automatically adds a default route, so remove the static route:

--> no route outside 0.0.0.0 0.0.0.0 192.168.10.1 1

[Richard Burts]

The config posted appears to be a reasonable starting point. In addition to the comment about the configured default route I note that there are 2 address translation statements

object network obj_any
nat (any,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface

I would think that the first one would be sufficient and wonder where the second one came from?

The configuration of the DHCP parameters suggests that the inside interface Gig1/2 is connected to a switch and that your inside network devices are connected to that switch. Is this the case? If so then tell us

- do the devices receive appropriate IP address, mask, and gateway?

- can the devices ping the ASA inside interface address?

- can the devices ping 8.8.8.8?

- if the device attempts to ping some Internet resource by name, does the name correctly resolve to an IP address?

- if the device attempts to ping some Internet resource by name, does the ping succeed?

[hyjeon]

Thanks Georg for your reply.

I removed the static route as you said but the internet is still not working.

here's the outside interface. I can see an IP has assigned from ISP router to the 5506

ciscoasa(config)# show int gi1/1
Interface GigabitEthernet1/1 "outside", is up, line protocol is up
Hardware is Accelerator rev01, BW 1000 Mbps, DLY 10 usec
Auto-Duplex(Full-duplex), Auto-Speed(1000 Mbps)
Input flow control is unsupported, output flow control is off
MAC address b0aa.777c.a9f4, MTU 1500
IP address 192.168.10.19, subnet mask 255.255.255.0

[Georg Pauwen]

Hello,

the ISP router needs to have a route back to the 192.168.0.0/24 network. Do you have access to that router ?

[hyjeon]

Yes I do as the ISP router is actually a TPlink home router. 

ISP(tplink router)

WAN(DHCP)

LAN(192.168.10.2-192.168.10.254)

GW 192.168.10.1

I connected a LAN cable from one of LAN ports of the tplink router to GI1/1 of ASA5506

Is there something I need to change in the tplink router? since this is my test lab, I have access to the router but if it's a real ISP router, I don't have access. And as far as I know, as long as I can get an ip from ISP router, rest should be done from the Cisco firewall or router.

Please advise if I'm wrong..

Thanks very much for your time and help..

[Richard Burts]

I am puzzled at this statement

the ISP router needs to have a route back to the 192.168.0.0/24 network

That would be true if the ASA were not doing address translation. But clearly the ASA is configured to do address translation.

Your output shows that the outside interface is up and has learned an IP address. So the next step is to test whether the ASA is able to access the next step ISP router. If the ASA is able to access the ISP router then the following step would be whether the ASA is able to access any resources in the Internet.

[Georg Pauwen]

Richard is right..my bad.

Try a packet tracer ping to the LAN interface of the ISP router and a public IP address on the Internet, and post the output of both results:

packet-tracer input inside icmp 192.168.0.1 8 0 192.168.10.1 detailed

packet-tracer input inside icmp 192.168.0.1 8 0 8.8.8.8 detailed

[hyjeon]

Hello Georg,

Here's the results.

ciscoasa(config)# packet-tracer input inside icmp 192.168.0.1 8 0 192.168.10.1$

Result:
input-interface: inside
input-status: down
input-line-status: down
Action: drop
Drop-reason: (interface-down) Interface is down

ciscoasa(config)# packet-tracer input inside icmp 192.168.0.1 8 0 8.8.8.8 deta$

Result:
input-interface: inside
input-status: down
input-line-status: down
Action: drop
Drop-reason: (interface-down) Interface is down

[hyjeon]

Hello Rick,

thanks very much for your reply. please see below.

the main problem is that although my laptop get an ip from gi1/2, I can't access the internet. 

[Georg Pauwen]

Hello,

what is the output of:

show int gi1/2

[Richard Burts]

Thanks for the information. The output of packet tracer seems to indicate a problem with the inside interface. But your laptop gets an IP address which suggests that the interface is working. Would you attempt to access something from your laptop and then do these commands and post the output

arp -a

ipconfig

[hyjeon]

Hi Rick,

here's the result.

I think I need to a routing command that transfers traffic from GI1/2 to GI1/1. aww I clearly remember I made it work when I studied the CCNA but I can't fix it now..ha..

[hyjeon]

The GI1/1 gets an 192.168.10.19 from the ISP router and I just realized that I needed to add "route outside 0.0.0.0 0.0.0.0 192.168.10.19 1 if it's a static IP from the ISP router.

In case the GI1/1 gets an IP from DHCP, how do I apply it to above route outside commmand?

.

Nope. I think I misunderstood.

[Richard Burts]

Your responses with the information that I requested and that @Georg Pauwen requested show clearly that the inside interface is working. though I do wonder about the number of drops

8604 packets dropped

But for now I am not sure that we need to address that at this point.

I am taking another look at the config that you posted. Is this still an accurate representation of the environment? In the meantime - would you attempt access to Internet from laptop and then check the logs of the ASA for any messages? I am wondering whether the issue is something on ASA or if it might be something on tplink.