Firewall issue between two sites ASA 5512

[travis1974]

Hello all,

I have a minor issue with being able to talk to a home office.

Here's my config:

PDX IP: x.x.x.x (publicly available and working)

SLM IP: x.x.x.x (publicly available and working)

PDX EPL/P2P IP: 10.3.2.1

Gateway for PDX EPL/P2P: 10.3.2.2

PDX EPL/P2P IP: 10.3.2.2

Gateway for PDX EPL/P2P: 10.3.2.1

PDX internal network: 10.3.1.0/24

SLM internal network: 192.168.2.0/24

Now here's the odd part.  I set up a rule within the global area to allow pinging across the board, and I can ping computers on both to and from both offices.  I've attached a screenshot to this post to show you what I mean

However, I cannot do anything else.  I can't open up a network share, ssh into anything, etc.

I've tried adding rules on both ASA's (I have identical 5512's one in each office) such as adding an outgoing rule allowing all traffic on the LAN and P2P interfaces, allowing all traffic from the internal network to the home office and vice versa under the global rules, etc.  None seem to help.  

I've made sure that all traffic is allowed on the same security level is allowed as well.

I'm getting close to out of ideas, but I get the feeling this is a simple fix.  Any help would be GREATLY appreciated.

Also note, I am using the java gui client for my configuring things, as I'm not comfortable enough yet on the command line for Cisco gear, so any helpful solutions would be great to know where to find it in there.

Thank you all in advance for any and all help!

Travis

[travis1974]

Also guys, I managed to get a working config dump.  I've taken out identifiable info of course. :)  See below:

Result of the command: "show running-config"

: Saved
:
ASA Version 9.1(2) 
!
hostname SLMASA5512
domain-name xxxx.local
enable password blahblahpassword encrypted
names
!
interface GigabitEthernet0/0
 nameif WAN
 security-level 0
 ip address x.x.x.x 255.255.255.252 
!
interface GigabitEthernet0/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/2
 nameif P2P
 security-level 100
 ip address 10.3.2.2 255.255.255.252 
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 nameif LAN
 security-level 100
 ip address 192.168.2.9 255.255.255.0 
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 192.168.1.1 255.255.255.0 
!
ftp mode passive
dns server-group DefaultDNS
 domain-name xxxx.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network PDX_Internal_Network
 subnet 10.3.1.0 255.255.255.0
 description Portland's Internal Network
access-list P2P_access_in extended permit ip any any 
access-list global_access extended permit icmp any4 any4 
access-list LAN_access_in extended permit ip any any 
pager lines 24
logging enable
logging asdm informational
mtu WAN 1500
mtu P2P 1500
mtu LAN 1500
mtu management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
nat (LAN,WAN) after-auto source dynamic any interface
access-group P2P_access_in in interface P2P
access-group LAN_access_in in interface LAN
access-group global_access global
route WAN 0.0.0.0 0.0.0.0 50.207.26.129 2
route P2P 10.3.1.0 255.255.255.0 10.3.2.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
 class class-default
  user-statistics accounting
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
hpm topN enable
Cryptochecksum:5321917393ae2cc427bd4d25ca87b10f
: end

[travis1974]

Solved my own issue! Hooray!

The issue was we have fiber internet going into our network switch, and we also had our old cable modem going into it as well for existing people.

The existing servers had a gateway of 10.3.1.8 (cable modem) and I tried to get onto them from the fiber internet, and it wouldn't return to the fiber internet way (10.3.1.9)

So, when I changed the server's gateway to 10.3.1.9, all of a sudden, everything worked perfectly.  

Thank you all anyway for your help!

Travis