Connecting ASA5520 to 1941 Router

[hawkeyeg]

I am having trouble configuring  my ASA I can get to the internet from the Router but not from the ASA.  What have I missed?  Please help.

[hawkeyeg]

Here is the config for the ASA5520.

: Saved
:
: Serial Number: JMX1024K166
: Hardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
:
ASA Version 8.2(5)57
!
hostname HawkASA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
nameif Outside
security-level 0
ip address 10.10.100.2 255.255.255.0
!
interface GigabitEthernet0/1
nameif Inside
security-level 100
ip address 10.10.150.1 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif Management
security-level 70
ip address 192.168.35.1 255.255.255.0
!
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
pager lines 24
logging enable
logging asdm informational
mtu Outside 1500
mtu Inside 1500
mtu Management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (Outside) 1 interface
nat (Inside) 1 10.10.150.0 255.255.255.0
static (Inside,Outside) 10.10.100.0 10.10.150.0 netmask 255.255.255.0
route Outside 0.0.0.0 0.0.0.0 10.10.100.1 1
route Inside 192.168.150.0 255.255.255.0 192.168.150.10 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.10.150.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username Hawk password 0p57cUqGdokWpRYH encrypted privilege 15
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:e0949dcb470194d08f78bf8b6bdcf4ec
: end

Thanks

[hawkeyeg]

Here is the config for the router if needed

Building configuration...

Current configuration : 3034 bytes
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
service password-encryption
!
hostname HawkR2
!
boot-start-marker
boot-end-marker
!
enable secret 5 $1$jFli$HZO3Ktnb.Zvldr78yxzGU.
enable password 7 095C6E1A0A5445415F
!
no aaa new-model
memory-size iomem 25
clock timezone PCTime -5
clock summer-time PCTime date Apr 6 2003 2:00 Oct 26 2003 2:00
!
no ipv6 cef
ip source-route
ip cef
!
!
!
!
multilink bundle-name authenticated
!
!
crypto pki trustpoint TP-self-signed-4088711382
enrollment selfsigned
subject-name cn=IOS-Self-Signed-Certificate-4088711382
revocation-check none
rsakeypair TP-self-signed-4088711382
!
!
crypto pki certificate chain TP-self-signed-4088711382
certificate self-signed 01
3082023E 308201A7 A0030201 02020101 300D0609 2A864886 F70D0101 04050030
31312F30 2D060355 04031326 494F532D 53656C66 2D536967 6E65642D 43657274
69666963 6174652D 34303838 37313133 3832301E 170D3137 30373330 30313033
35305A17 0D323030 31303130 30303030 305A3031 312F302D 06035504 03132649
4F532D53 656C662D 5369676E 65642D43 65727469 66696361 74652D34 30383837
31313338 3230819F 300D0609 2A864886 F70D0101 01050003 818D0030 81890281
8100C4BA C65883E0 D46DFDCE F4D172AF A9B93A02 CA336DD4 BF669F66 1786B5A8
D1AAD880 B2DD6205 F2C5BB91 ACD30D6B 91684969 F06B7CAC 790A7F59 11D58DCF
CFBCB0D7 D384DD03 8187CA9A ABD6E7CD AEB7CCB6 7CA8E6E5 2B3CBBCB 1B3BDFA2
42AA55CA A9209CE8 CBE392C3 353C23AC 468B8F5A FFBE1540 C47A7EA3 3F135EA7
101D0203 010001A3 66306430 0F060355 1D130101 FF040530 030101FF 30110603
551D1104 0A300882 06486177 6B523230 1F060355 1D230418 30168014 437642EC
D6AFABE7 156A05BF A0093A9A 9F7DB73A 301D0603 551D0E04 16041443 7642ECD6
AFABE715 6A05BFA0 093A9A9F 7DB73A30 0D06092A 864886F7 0D010104 05000381
8100967A C2997656 2357192F 0B6C6C73 FC5DA41A 3C9439C9 7963117C C2DC82E8
D70319FE 8BFC333B 98D8EDA0 EEA5ECA9 3A381FD4 1314B99B 9991C8A1 CF191CF1
996D5A5F 57477DB9 A6CEC5B6 84FCF60D F16B2512 1685C961 89F4CD89 A37C9213
24BE686B AA945ACA E8EA0739 315B1371 57A8402F 6EA2D197 FE08C5BC 2F73557A 8699
quit
license udi pid CISCO1941/K9 sn FTX151801HR
!
!
username admin privilege 15 password 7 110A1016141D
!
!
!
!
!
!
interface GigabitEthernet0/0
ip address 192.168.2.2 255.255.255.0
ip nat outside
ip virtual-reassembly
duplex auto
speed auto
no mop enabled
!
interface GigabitEthernet0/1
ip address 10.10.100.1 255.255.255.0
ip nat inside
ip virtual-reassembly
duplex auto
speed auto
no mop enabled
!
ip forward-protocol nd
!
ip http server
ip http authentication local
ip http secure-server
!
ip nat inside source list 1 interface GigabitEthernet0/0 overload
ip route 0.0.0.0 0.0.0.0 192.168.2.1
!
access-list 1 remark CCP_ACL Category=2
access-list 1 permit 10.10.100.0 0.0.0.255
dialer-list 1 protocol ip permit
!
!
!
control-plane
!
!
line con 0
exec-timeout 45 0
logging synchronous
line aux 0
line vty 0 4
password 7 0822455D0A16
login local
transport input telnet ssh
!
scheduler allocate 20000 1000
end

hope this help.

[Julio E. Moisa]

Hi

You are connecting both devices to internet separately, right? 

I see different next-hops on the static routes, on the router is 192.168.x.x and on the router I see 10.x.x.x.

How is connected this topology?

[hawkeyeg]

The 1941 is connected to the internet then the ASA is connected to the router.  Once the ASA is working I will be adding a switch to the ASA that why there is a extra line in the ASA config.

[Julio E. Moisa]

Hi

Usually, the firewall is connected to Internet directly, I could remove the router and leave the ASA connected to Internet, otherwise there are no reason to configure a NAT on the firewall because the Router 1941 is already translating the traffic to the Public IPs, the firewall could work for Filtering only. 

[hawkeyeg]

Ok I remove the nat from the ASA.  Do you suggest I go straight from the internet to the ASA then to a switch and leave out the router.

[Julio E. Moisa]

Yes, that is correct, but make it before I suggest upgrade the IOS of the firewall, version 8.2 was developed a long time, in order to avoid bugs or vulnerabilities you should install 9.1+

Some commands will change after the upgrade including the NAT

http://www.cisco.com/c/en/us/td/docs/security/asa/asa91/configuration/firewall/asa_91_firewall_config/nat_overview.html

[hawkeyeg]

I cannot upgrade till I install more memory I already check into that. When I remove my router I lost my wifi it would not connect so I need the router at the moment.

[hawkeyeg]

I got it working here is the ASA config I used

: Saved
:
: Serial Number: JMX1024K166
: Hardware: ASA5520, 512 MB RAM, CPU Pentium 4 Celeron 2000 MHz
:
ASA Version 8.2(5)57
!
hostname HawkASA
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
nameif Outside
security-level 0
ip address 10.10.100.2 255.255.255.0
!
interface GigabitEthernet0/1
nameif Inside
security-level 100
ip address 10.10.150.1 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif Management
security-level 70
ip address 192.168.35.1 255.255.255.0
!
ftp mode passive
pager lines 24
mtu Outside 1500
mtu Inside 1500
mtu Management 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
static (Inside,Outside) 10.10.100.0 10.10.150.0 netmask 255.255.255.0
route Outside 0.0.0.0 0.0.0.0 10.10.150.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.10.150.0 255.255.255.0 Inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
username admin password f3UhLvUj1QsXsuK7 encrypted privilege 15
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:8d88d58d36edc8eb573bcdb563c345f3
: end

Thanks for all your help!!!!