Switch connected to Router cannot ping Internet

[tylerphillippe]

Hello all,

I have an ASA 5512-X set up. It received a DHCP address from our ISP and it can ping the internet (8.8.8.8) just fine. I attached a switch to the Inside port on the router, but it CANNOT ping the internet (8.8.8.8). The router can ping the switch's attached interface, the vlans I have set up and clients on those vlans. The switch can ping the vlans and the clients and it can ping the directly attached router. When I attach a machine directly to the router, it can get to the internet just fine. I'm attaching the router and switch configuration. What am I missing here?

[Julio E. Moisa]

Hi 

Try to use the following command lines::

object-group network INSIDE-SUBNETS
network-object 192.168.2.0 255.255.255.0
network-object 192.168.2.0 255.255.255.0

nat (inside,outside) source dynamic INSIDE-SUBNETS interface  <-- instead of your current NAT configuration.

Always make a backup. 

[tylerphillippe]

Julio,

I tried that config and the switch and clients still cannot get out to the Internet.

[Julio E. Moisa]

are you trying ping only? or from the browser? if it is icmp, probably you need to open icmp on your ACL. 

access-list inside_access_in extended permit icmp any any

access-list outside_access_in extended permit icmp any any

access-group outside_access_in in interface outside

Also execute:

show xlate

to see the translations. 

* Is good practice to use capital letters using acls.

[tylerphillippe]

Ping from the switch and trying to get to google.com using the browser from the client computer.

[Julio E. Moisa]

Ok please let me double check, also enable ip routing on the switch.

[tylerphillippe]

Okay. ip routing is already enabled on the switch.

[Julio E. Moisa]

I saw the problem

You need to create default route on the firewall. 

route outside 0 0 <IP of your next hop>

[Julio E. Moisa]

that default route should fix the problem

[tylerphillippe]

That didn't work. The router has an IP from DHCP from the ISP and it was automatically adding the default route. But, I manually added it and the client still cannot get to google.com. The ASA can still ping 8.8.8.8

[Julio E. Moisa]

if you execute a traceroute from your firewall to 8.8.8.8 can you see your next hop IP? so that IP should be configured on the default route. 

[tylerphillippe]

That didn't work either. Stopped all traffic from the ASA. 

[andrewswanson]

When you ping from the switch, the source ip will be 192.168.0.2. Can you ping google.com from the switch using one of your SVIs?

ping 8.8.8.8 source vlan 2

hth
Andy

[tylerphillippe]

No dice. No connection from vlan 2's interface either.

[Julio E. Moisa · Accepted solution]

Just for testing purposes configure these lines on the firewall. 

access-list outside_access_in permit extended icmp any any echo
access-list outside_access_in permit extended icmp any any echo-reply

access-group outside_access_in in interface outside

access-list inside_access_in permit line 1 extended icmp any any echo
access-list inside_access_in permit line 2 extended icmp any any echo-reply

Could you pleas share the output related to the traceroutes.