Cannot route inside traffic to the outside on ASA

[marianodaniel]

show inter ip br
Interface                  IP-Address      OK? Method Status                Protocol
Virtual0                   127.1.0.1       YES unset  up                    up  
GigabitEthernet1/1         192.168.0.100   YES DHCP   up                    up  
GigabitEthernet1/2         10.10.10.1      YES unset  up                    up  
GigabitEthernet1/3         10.10.10.1      YES unset  down                  down
GigabitEthernet1/4         10.10.10.1      YES unset  down                  down
GigabitEthernet1/5         10.10.10.1      YES unset  down                  down
GigabitEthernet1/6         10.10.10.1      YES unset  down                  down
GigabitEthernet1/7         10.10.10.1      YES unset  down                  down
GigabitEthernet1/8         unassigned      YES DHCP   down                  down
Internal-Control1/1        127.0.1.1       YES unset  up                    up  
Internal-Data1/1           unassigned      YES unset  up                    down
Internal-Data1/2           unassigned      YES unset  up                    up  
Internal-Data1/3           unassigned      YES unset  up                    up  
Internal-Data1/4           169.254.1.1     YES unset  up                    up  
Management1/1              unassigned      YES unset  down                  down
BVI1                       10.10.10.1      YES CONFIG up                    up  

# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/14/20 ms

# show route   

Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area 
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, V - VPN
       i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
       ia - IS-IS inter area, * - candidate default, U - per-user static route
       o - ODR, P - periodic downloaded static route, + - replicated route
Gateway of last resort is 192.168.0.1 to network 0.0.0.0

S*       0.0.0.0 0.0.0.0 [1/0] via 192.168.0.1, outside
S        0.0.0.0 255.255.255.0 [1/0] via 192.168.0.1, inside
C        10.10.10.0 255.255.255.240 is directly connected, inside
L        10.10.10.1 255.255.255.255 is directly connected, inside
C        192.168.0.0 255.255.255.0 is directly connected, outside
L        192.168.0.100 255.255.255.255 is directly connected, outside

I don't understand why hosts in 10.10.10.0/28 are unable to reach the internet through the outside interface. What am I doing wrong?

[David Ruess]

Hello,

Does the outside network know how to get back to the FW for the 10.10.10.0/28 network? Can you provide a diagram and configuration for both your FW and router?

-David

[marianodaniel]

Hello @David Ruess ! I tried configuring a static route back, but I'm unable to do so:

ciscoasa(config)# route outside 10.10.10.0 255.255.255.240 10.10.10.1
ERROR: Cannot add route, connected route exists

ciscoasa(config)# route outside 0 255.255.255.240 10.10.10.1         
ERROR: Invalid next hop address 10.10.10.1, it matches our IP address

Diagram is very simple: ISP router --> Cisco ASA --> Hosts

Outside interface is in 192.168.0.0/24 for the ISP router and the inside interface is in 10.10.10.0/28 for the hosts.

[Richard Burts]

We do not have much information to work with. Based on the very little information that we have it might possibly be a routing issue. But my best guess at this point is that it might be that NAT is not working (perhaps not configured) for the inside addresses.

Can you provide some details of the ASA config?

[David Ruess]

As myself and @Richard Burts mentioned a config of the FW and router would be helpful as well. You can upload text files if needed. Richard may be on to something with the 10.10.10.0/28 space not being NAT'd out the outside IP.

-David

[kirank10]

hi ,
Common Cause: NAT is Missing
When internal hosts  try to access the internet via a private IP, you must perform source NAT (PAT) on the router/firewall so that the source IP appears to be the public IP