Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Create a new article
1203
Views
0
Helpful
2
Comments

Not able to access Internet through asa 5505 firewall

m.aladili
Community Member

‎05-07-2013 03:19 AM - edited ‎03-08-2019 06:49 PM

Hi,

I have Cisco Firewall ASA 5505 it is all ready configured and work fine but befor 2 weeks i have a problem,

i can't access Internet i don't no why please any one can help me

Firewall configuration :

ASA Version 7.2(4)

!

hostname woodrocasa

domain-name woodroc.local

enable password 2KFQnbNIdI.2KYOU encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Vlan1

no forward interface Vlan2

nameif inside

security-level 100

ip address 192.168.5.254 255.255.255.0

ospf cost 10

!

interface Vlan2

nameif outside

security-level 0

ip address 212.11.160.20 255.255.255.240

ospf cost 10

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

dns server-group DefaultDNS

domain-name woodroc.local

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list inside_access_in extended permit ip any any

access-list outside_access_in extended permit ip any any

access-list outside_access_in remark Allow FTP for all.

access-list outside_access_in extended permit ip any host 212.11.160.18

access-list outside_access_in extended permit ip any host 192.168.5.21

access-list outside_access_in remark Remote Access from Outside.

access-list outside_access_in extended permit tcp any host 212.11.160.30 eq 3389

access-list outside_access_in remark SMTP

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq smtp

access-list outside_access_in remark SMTPs

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq 465

access-list outside_access_in remark POP3

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq pop3

access-list outside_access_in remark POP3s

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq 995

access-list outside_access_in remark Allow Access to OWA

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq www

access-list outside_access_in remark Allow Secure Access to OWA

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq https

access-list outside_access_in remark IMAP

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq imap4

access-list outside_access_in remark IMAPs

access-list outside_access_in extended permit tcp any host 192.168.5.21 eq 993

access-list outside_access_in remark Allow Access to Web Server

access-list outside_access_in extended permit tcp any host 192.168.5.22 eq www

access-list outside_access_in remark Allow Secure Access to Web Server

access-list outside_access_in extended permit tcp any host 192.168.5.22 eq https

access-list outside_access_in extended permit tcp any host 192.168.5.22 eq 801

access-list outside_access_in extended permit ip any host 212.11.160.19

access-list outside_access_in extended permit ip any host 212.11.160.26

access-list outside_access_in extended permit tcp any host 192.168.10.96 eq 8001

access-list outside_access_in extended permit tcp any host 192.168.10.97 eq 8002

access-list outside_access_in extended permit tcp any host 192.168.10.98 eq 8003

access-list outside_access_in extended permit tcp any host 192.168.10.116 eq 8004

access-list outside_access_in extended permit tcp any host 192.168.10.91 eq 8005

access-list outside_access_in extended permit tcp any host 192.168.10.106 eq 8006

access-list outside_access_in extended permit tcp any host 192.168.10.95 eq 8007

access-list outside_access_in extended permit tcp any host 192.168.10.112 eq 8008

access-list outside_access_in extended permit tcp any host 192.168.10.99 eq 8009

access-list outside_access_in extended permit tcp any host 192.168.10.87 eq 8010

access-list outside_access_in extended permit tcp any host 192.168.10.80 eq 8011

access-list outside_access_in extended permit tcp any host 192.168.10.90 eq 8012

access-list outside_access_in extended permit tcp any host 192.168.10.108 eq 8013

access-list outside_access_in extended permit tcp any host 192.168.10.49 eq 8014

access-list outside_access_in extended permit tcp any host 192.168.10.100 eq 8015

access-list outside_access_in extended permit tcp any host 192.168.10.110 eq 8016

access-list outside_access_in extended permit tcp any host 192.168.10.83 eq 8017

access-list outside_access_in extended permit tcp any host 192.168.10.88 eq 8018

access-list outside_access_in extended permit tcp any host 192.168.10.82 eq 8019

access-list outside_access_in extended permit tcp any host 192.168.10.112 eq 8020

access-list outside_access_in extended permit tcp any host 192.168.10.109 eq 8021

access-list outside_access_in extended permit tcp any host 192.168.10.101 eq 8022

access-list outside_access_in extended permit tcp any host 192.168.10.89 eq 8023

access-list outside_access_in extended permit tcp any host 192.168.10.104 eq 8024

access-list outside_access_in extended permit tcp any host 192.168.10.86 eq 8025

access-list outside_access_in extended permit tcp any host 192.168.10.111 eq 8026

access-list outside_access_in extended permit icmp any any

access-list inside_nat0_outbound extended permit ip any 192.168.10.128 255.255.255.224

access-list inside_nat0_outbound extended permit ip any 212.11.160.28 255.255.255.254

access-list inside_nat0_outbound extended permit ip any 212.11.160.24 255.255.255.248

access-list outside-2_access_in extended permit ip any any

pager lines 24

logging enable

logging asdm informational

logging from-address asa_fw@woodroc.com

logging recipient-address s.ramadan@woodroc.com level alerts

logging ftp-bufferwrap

logging ftp-server 192.168.5.21 asa_logs administrator ****

mtu inside 1500

mtu outside 1500

ip local pool WR 212.11.160.27-212.11.160.28 mask 255.255.255.240

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-524.bin

no asdm history enable

arp timeout 14400

global (inside) 1 192.168.10.96-192.168.10.97 netmask 255.255.255.0

global (outside) 1 interface

global (outside) 2 212.11.160.24 netmask 255.255.255.240

global (outside) 4 192.168.6.14 netmask 255.255.255.0

global (outside) 5 212.11.160.26 netmask 255.255.255.0

global (outside) 3 212.11.160.23 netmask 255.255.255.240

nat (inside) 0 access-list inside_nat0_outbound

nat (inside) 2 192.168.5.0 255.255.255.0 dns

static (inside,outside) tcp 212.11.160.26 8001 192.168.10.96 8001 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8002 192.168.10.97 8002 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8003 192.168.10.98 8003 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8004 192.168.10.116 8004 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8005 192.168.10.91 8005 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8006 192.168.10.106 8006 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8007 192.168.10.95 8007 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8008 192.168.10.112 8008 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8009 192.168.10.99 8009 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8010 192.168.10.87 8010 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8011 192.168.10.80 8011 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8012 192.168.10.90 8012 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8013 192.168.10.108 8013 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8014 192.168.10.49 8014 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8015 192.168.10.100 8015 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8016 192.168.10.110 8016 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8017 192.168.10.83 8017 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8018 192.168.10.88 8018 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8019 192.168.10.82 8019 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8020 192.168.10.117 8020 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8021 192.168.10.109 8021 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8022 192.168.10.101 8022 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8023 192.168.10.89 8023 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8024 192.168.10.104 8024 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8025 192.168.10.86 8025 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.26 8026 192.168.10.111 8026 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.19 www 192.168.5.22 www netmask 255.255.255.255  dns

static (inside,outside) tcp 212.11.160.19 3389 192.168.5.22 3389 netmask 255.255.255.255

static (inside,outside) tcp 212.11.160.19 ftp 192.168.5.22 ftp netmask 255.255.255.255  dns

static (inside,outside) 212.11.160.18 192.168.5.21 netmask 255.255.255.255

static (inside,outside) 212.11.160.30 192.168.5.24 netmask 255.255.255.255

static (inside,outside) 212.11.160.21 192.168.10.145 netmask 255.255.255.255

static (inside,outside) 212.11.160.23 192.168.10.148 netmask 255.255.255.255

static (inside,outside) 212.11.160.22 192.168.10.170 netmask 255.255.255.255

static (inside,outside) 212.11.160.29 192.168.10.161 netmask 255.255.255.255

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

route inside 192.168.10.0 255.255.255.0 192.168.5.1 1

route outside 0.0.0.0 0.0.0.0 212.11.160.17 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

http server enable

http 192.168.10.143 255.255.255.255 inside

http 192.168.5.24 255.255.255.255 inside

http 192.168.10.55 255.255.255.255 inside

http 192.168.1.0 255.255.255.0 inside

http 212.11.191.0 255.255.255.0 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set TRANS_ESP_3DES_SHA esp-3des esp-sha-hmac

crypto ipsec transform-set TRANS_ESP_3DES_SHA mode transport

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto dynamic-map outside_dyn_map 20 set pfs group1

crypto dynamic-map outside_dyn_map 20 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 40 set pfs group1

crypto dynamic-map outside_dyn_map 40 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 60 set pfs group5

crypto dynamic-map outside_dyn_map 60 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 80 set pfs group1

crypto dynamic-map outside_dyn_map 80 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 100 set pfs group1

crypto dynamic-map outside_dyn_map 100 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 120 set pfs group1

crypto dynamic-map outside_dyn_map 120 set transform-set TRANS_ESP_3DES_SHA

crypto dynamic-map outside_dyn_map 140 set pfs group1

crypto dynamic-map outside_dyn_map 140 set transform-set ESP-3DES-SHA

crypto dynamic-map inside_dyn_map 20 set pfs group1

crypto dynamic-map inside_dyn_map 20 set transform-set TRANS_ESP_3DES_SHA

crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map

crypto map outside_map interface outside

crypto map inside_map 65535 ipsec-isakmp dynamic inside_dyn_map

crypto map inside_map interface inside

crypto isakmp enable inside

crypto isakmp enable outside

crypto isakmp policy 10

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption 3des

hash md5

group 5

lifetime 86400

crypto isakmp policy 50

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

client-update enable

telnet 192.168.5.24 255.255.255.255 inside

telnet 192.168.1.0 255.255.255.0 inside

telnet 192.168.10.55 255.255.255.255 inside

telnet 192.168.10.143 255.255.255.255 inside

telnet 0.0.0.0 0.0.0.0 outside

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

dhcp-client broadcast-flag

dhcpd auto_config outside

!

vpnclient server 192.168.10.143

vpnclient mode client-mode

vpnclient vpngroup woodroc password ********

group-policy DfltGrpPolicy_1 internal

group-policy DfltGrpPolicy_1 attributes

dns-server value 192.168.5.20 192.168.5.21

vpn-tunnel-protocol l2tp-ipsec

group-policy woodroc internal

group-policy woodroc attributes

dns-server value 192.168.5.20 192.168.5.28

vpn-tunnel-protocol l2tp-ipsec

default-domain value woodroc.local

username saleh-ramadan password 05FiDMwloggBHwl9ZIkEUw== nt-encrypted privilege 0

username saleh-ramadan attributes

vpn-group-policy Woodroc

tunnel-group DefaultRAGroup general-attributes

address-pool WR

tunnel-group DefaultRAGroup ipsec-attributes

pre-shared-key *

!

!

prompt hostname context

Cryptochecksum:28ceb2736bf4526bd1f5697b7e201c7c

: end

Labels:
0 Helpful
Comments
mvsheik123
Level 7
Level 7
‎05-07-2013 10:49 AM

Hello,

Please post any issues as 'discussion'. Can you try by removing 'no forward interface Vlan2' command from int Vla1?

interface Vlan1

no forward interface Vlan2

nameif inside

security-level 100

ip address 192.168.5.254 255.255.255.0

ospf cost 10

Thx

MS

m.aladili
Community Member
‎05-10-2013 11:55 PM

Hello

,I try removing but still same problem, I think reset firewall to

factory default and configure again.

Thx

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Customers Also Viewed These Support Documents