ASA 5505 Problem Getting Started

[Patrick McHenry]

Hi,

New to Firewalls:

I set the ASA to factory default using the config factory default. Then, I plugged my PC into port 7 and the Comcast modem into port 0 and got a 192.168.1.2 ip address for my PC. Also, configured the dhcp to give out the dns addresses. Changed the outside interface address to my assigned static address but still can't ping the outside interface or Google from PC. Oh, also, from the firewall I can ping the gateway-Comcast address but, no further.

Where should I start to get this thing working?

Thanks, Pat.

[Patrick McHenry]

Thanks, Jouni

Could you look at this config and point out what config is actually protecting the inside and or dmz if any?

Thanks, Pat.

SJHCOMCASTFW# sh run
: Saved
:
ASA Version 7.2(4)
!
hostname SJHCOMCASTFW
domain-name sjhcomcast.com
enable password 2KFQnbNIdI.2KYOU encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 50.79.xx.xx 255.255.255.252
!
interface Vlan12
no forward interface Vlan1
nameif dmz
security-level 50
ip address 192.168.2.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
switchport access vlan 12
!
interface Ethernet0/4
switchport access vlan 12
!
interface Ethernet0/5
!
interface Ethernet0/6
switchport access vlan 12
!
interface Ethernet0/7
switchport access vlan 12
!
ftp mode passive
dns server-group DefaultDNS
domain-name sjhcomcast.com
same-security-traffic permit intra-interface
access-list 100 extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
nat (dmz) 1 0.0.0.0 0.0.0.0
access-group 100 in interface outside
route outside 0.0.0.0 0.0.0.0 50.79.xx.xx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd dns 8.8.8.8 75.75.75.75 interface inside
dhcpd lease 86400 interface inside
dhcpd ping_timeout 3600 interface inside
dhcpd domain sjhcomcast.com interface inside
dhcpd enable inside
!
dhcpd address 192.168.2.2-192.168.2.33 dmz
dhcpd dns 8.8.8.8 75.75.75.75 interface dmz
dhcpd lease 86400 interface dmz
dhcpd ping_timeout 3600 interface dmz
dhcpd domain sjhcomcast.com interface dmz
dhcpd enable dmz
!

username PMcHenry password DFlVIADtck1VpZzU encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:c30a7374fcd57d95935dc38912572a3c
: end

[Jouni Forss]

Hi,

Well the fact that you havent opened anything (but ICMP) from  the Internet/outside means that no connections can be initiated to your DMZ and INSIDE networks from the OUTSIDE.

Though since you are doing Port Address Translation (PAT) to the outside (from DMZ and INSIDE) already mean that a single host can't be accessed from the OUTSIDE interface as none of the DMZ and INSIDE hosts have their own public IP address but share the outside interface IP.

Also it seems you have a Base License version of the ASA 5505? Since you have the command "no forward interface Vlan1" means that your hosts behind the DMZ interface can't initiate connections to the INSIDE network.

Though you can still initiate connections from INSIDE to DMZ. The above "no forward" command only restricts the connections that DMZ can take towards INSIDE / Vlan1

- Jouni

[Patrick McHenry]

As I don't want inside to initiate with dmz, I could also enter the command no forward interface Vlan12 on the inside interface?

Thanks.

[Jouni Forss · Accepted solution]

Hi,

To be honest I haven't tried.

I also have an ASA 5505 with Base License at home but I have no need for a DMZ in my network so I havent tried it.

You could always make an access-list for your INSIDE interface and handle the traffic with it. Its the more common way atleast.

You could basicly do following simple configurations

access-list INSIDE-IN remark Block INSIDE to DMZ traffic

access-list INSIDE-IN deny ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list INSIDE-IN remark Allow all other traffic

access-list INSIDE-IN permit ip 192.168.1.0 255.255.255.0 any

access-group INSIDE-IN in interface inside

The above specifies the following things:

• INSIDE-IN is the access-list name
• The remark lines in the access-list just give a brief description of the rule below it
  • You can insert these remarks (or permit/deny lines) to different spots using the "line " after the access-list name
  • For example "access-list INSIDE-IN line 1 remark " would add a remark line at the top of the list.
  • On the CLI the line numbers are visible when you issue the "show access-list". "show run access-list" wont show line numbers
• The deny line states that all TCP/UDP traffic from INSIDE network range to DMZ network range is denied when entering the firewall interface inside
• The permit line allows all the traffic from INSIDE network range to any other network. (Basically allows all the traffic towards OUTSIDE interface as all traffic to DMZ was just denied on the earlier line in the access-list.
• The access-group line attaches the access-list named INSIDE-IN to the interface inside
  • The in paremeter tells the direction the access-list is applied
  • In this case its for traffic thats entering the inside interface

- Jouni

[Patrick McHenry]

Thanks Jouni!