ASA 5510 cannot connect to the internet

Answered Question
May 22nd, 2008
User Badges:

What's wrong or missing from the configuration below? No internet access. On the ASA, I can ping my T1 router:


T1 router - 69.X.X.193

Outside interface 69.X.X.196

Inside interface 10.10.1.254


asa5510(config)# show run

: Saved

:

ASA Version 8.0(2)

!

hostname asa5510

domain-name http://www.test.com

enable password XXXXXXXXXXXXXXXX encrypted

names

dns-guard

!

interface Ethernet0/0

nameif outside

security-level 0

ip address 69.X.X.196 255.255.255.248

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.10.1.254 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

passwd XXXXXXXXXXXXXXXX encrypted

ftp mode passive

dns server-group DefaultDNS

domain-name http://www.test.com

access-list incoming_traffic extended permit ip any any

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu management 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-611.bin

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

access-group incoming_traffic in interface outside

route outside 0.0.0.0 0.0.0.0 63.X.X.193 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout uauth 0:05:00 absolute

dynamic-access-policy-record DfltAccessPolicy

aaa authentication http console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

no crypto isakmp nat-traversal

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd address 192.168.1.2-192.168.1.254 management

!

threat-detection basic-threat

threat-detection statistics access-list

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns migrated_dns_map_1

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns migrated_dns_map_1

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

!

service-policy global_policy global

username testuser password XXXXXXXXXXXXXXXX encrypted

prompt hostname context

Cryptochecksum:xxx

: end

asa5510(config)#

Correct Answer by husycisco about 9 years 2 months ago

Hi Andrew,

Nothing is wrong with your ACL or NAT statements.

Your default static route is not within the range of your outside interfacce


route outside 0.0.0.0 0.0.0.0 63.X.X.193 1


Check it again.


Regards


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3.5 (6 ratings)
Loading.
arturo.guzman Thu, 05/22/2008 - 14:10
User Badges:
  • Bronze, 100 points or more

nat (inside) 1 0.0.0.0 0.0.0.0 // int this case you have to put your segmente lan maybe like this.


nat (inside) 1 10.10.1.0 255.255.255.0


or may be like this



nat (inside) 1 10.0.0.0 255.0.0.0


In other hand you have to make an acl for the inside interface maybe like this.


access-list inside_in extended permit ip 10.10.1.0 255.255.255.0 any


and apply it to the interface.


access-group inside_in in interface inside



don't forget qualify me



Correct Answer
husycisco Thu, 05/22/2008 - 16:13
User Badges:
  • Gold, 750 points or more

Hi Andrew,

Nothing is wrong with your ACL or NAT statements.

Your default static route is not within the range of your outside interfacce


route outside 0.0.0.0 0.0.0.0 63.X.X.193 1


Check it again.


Regards


vitripat Thu, 05/22/2008 - 16:41
User Badges:
  • Gold, 750 points or more

This is not a issue with either nat/global configuration or subnet mask. Outside interface and gateway IP are in the same subnet.


I think this is an issue with the upstream device. To verify, try this-


policy-map global_policy

class inspection_default

inspect icmp


Now check if from hosts on the inside interface, are you able to ping 63.X.X.193 and 4.2.2.2?


If you can ping 63.X.X.193 but not 4.2.2.2, traffic is passing through ASA, however not through the upstream device (router). Thats where you need to look in.


Regards,

Vibhor.

husycisco Thu, 05/22/2008 - 17:00
User Badges:
  • Gold, 750 points or more

Hi Vibhor,

"Outside interface and gateway IP are in the same subnet"

Following is the ip address statement for outside interface

!!!

ip address 69.X.X.196 255.255.255.248


and following is the default route

!!

route outside 0.0.0.0 0.0.0.0 63.X.X.193


How can 63.x.x.193 be within same subnet of 69.x.x.192/29 ?


According to the config of T1 router, the default route for ASA must either be the T1 router itself (69.x.x.193), or the default gateway assigned to T1 router by ISP within 69.x.x.192/29


vitripat Fri, 05/23/2008 - 09:38
User Badges:
  • Gold, 750 points or more

ahh .. i missed that .. :-) Thanks for pointing it out. :-)

Actions

This Discussion