Problems with Cisco ASA5510

Unanswered Question
Aug 27th, 2008
User Badges:

Hi, I need some help configuring a Cisco ASA5510 firewall. I have connected the ethernet0/0 interface to a D-Link DSL-504T router whose ip address is 192.168.1.1. The ethernet0/1 interface is connected to a 3Com OfficeConnect Dual Speed Switch 5 switch that provides connection to several hosts. At first, I wrote down a basic configuration in order to permit all traffic coming from the inside network and use the ping command, but the firewall drops every incoming packet from the LAN. When I ping the router there is no reply and I also can't surf on internet, but pings to the ethernet0/0 interface are replied. This is the whole list of commands I used:


interface ethernet 0/0

nameif outside

security-level 0

ip address 192.168.1.2 255.255.0.0

no shutdown

exit

interface ethernet 0/1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

no shutdown

exit

route outside 0 0 192.168.1.1 1

dhcpd address 10.0.0.2-10.0.0.254 inside

dhcpd dns 80.58.0.33 62.37.228.20

dhcpd enable inside

access-list 100 extended permit icmp any any echo-reply

access-list 100 extended permit icmp any any time-exceed

access-list 100 extended permit icmp any any unreachable

access-group 100 in interface outside

nat (inside) 1 10.0.0.0 255.255.255.0

global (outside) 1 192.168.3.100-192.168.3.150

global (outside) 1 192.168.3.200


What's wrong with these settings? Did I forget any important detail? In case the configuration is wrong, could you please post here any other basical one?


PD: The ASA5510 works in routed firewall mode.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (1 ratings)
Loading.
andrew.prince@m... Wed, 08/27/2008 - 04:52
User Badges:
  • Green, 3000 points or more

You are natting to a seperate IP subnet on the outside?


for testing cut and paste the below:-


global (outside) 2 interface

no nat (inside) 1 10.0.0.0 255.255.255.0

nat (inside) 2 10.0.0.0 255.255.255.0


re-test and post results.

miregistrocisco Thu, 08/28/2008 - 00:26
User Badges:

It works! but why am I natting to a separate subnet? 192.168.1.2 and 192.168.3.XXX addresses belong to the 192.168.0.0/16 subnet, don't they?

andrew.prince@m... Thu, 08/28/2008 - 00:42
User Badges:
  • Green, 3000 points or more

Yes they do - however it all depends on the next hop device. In your config you have:-



interface ethernet 0/0

nameif outside

security-level 0

ip address 192.168.1.2 255.255.0.0


route outside 0 0 192.168.1.1


global (outside) 1 192.168.3.100-192.168.3.150


OK - what is the mask on your next hop device facing the firewall?? /16 or /24 - does the router have arp enabled? Does the firewall have proxy arp enabled on the outside interface?


At the end - do you really need to NAT to a differnet IP subnet? Do you need 253 IP address for NAT?

miregistrocisco Thu, 08/28/2008 - 02:06
User Badges:

The router mask is /24, so that was the problem, I hadn't realised. I'll take care of mapped addresses in the future. Thanks a lot!

Actions

This Discussion