Setup ASA 5515x with internet connection

Answered Question
Nov 29th, 2013
User Badges:

I'm trying to figure out how to do a basic setup of our new ASA 5515x in a manner that will allow clients on the inside to access the internet.

I know the topic has been covered before in many post here, but I've read them all (all I could find anyway) tested their accepted solutions but without luck.

But given my ASA experience, which is zero, this could be my own fault.


I think the problem might be caused by the fact that internet is two hops away. The ASA is on a segment, which shares internet access with six other networks. So we got a NAT over NAT situation here. But this did not prevent our old linux based firewall from reaching the internet, so the obstacle should be possible to overcome.


The setup I'm trying to make work is as follows:

External IP XX.XX.XX.XX

ISP router - 192.168.3.1 (LAN side)


ASA5515x - 192.168.3.6 outside / 192.168.0.1 inside / 192.168.1.1 managment


The question is how to give clients on the inside of the ASA access to the internet in this situation?


I followed the setup wizard (yes, I'm using ASDM) to get the basics in place. No luck.

After reading about other ASA owners without internet I found a Cisco guide on how to give two internal networks internet access. Followed half the guide, since I only have one net on the inside. (Basicly all I did was create i new NAT rule to NAT all inside IPs when going outside). Still no internet, but after this I could ping the ISP router from clients inside which was a great improvement. Pinging 8.8.8.8 or 4.2.2.2 is however always failing.


I also experimented with ping and trace in ADSM. No rute to host is always the result when using 8.8.8.8. Using 192.168.3.1 will however work in one direction. I did notice that some traffic is blocked by ACL, but I'm not sure that is a problem. The ASA is in factory setting when it comes to access rules.


Any help or advice is very very welcome!

Correct Answer by Jon Marshall about 3 years 8 months ago

It sounds like you have NAT setup okay. What you need though is a default route on your ASA so it knows where to send internet packets to. Sorry i don't use ADSM but on the command line it would be -


route outside 0.0.0.0 0.0.0.0 192.168.3.1


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
Jon Marshall Fri, 11/29/2013 - 07:01
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

It sounds like you have NAT setup okay. What you need though is a default route on your ASA so it knows where to send internet packets to. Sorry i don't use ADSM but on the command line it would be -


route outside 0.0.0.0 0.0.0.0 192.168.3.1


Jon

jumora Fri, 11/29/2013 - 21:22
User Badges:
  • Cisco Employee,

Please post configuration, we need to know if the NAT rule is correct, if the routing is setup, if the interfaces are correctly setup, if the security level are also, the information that you have provided is useful but we need more.



Value our effort and rate the assistance!

traknerud Sun, 12/01/2013 - 08:43
User Badges:

Jon, you're quite right.

I added a route for "everyone" inside (0.0.0.0) to the LAN IP of my ISP router, and voila. Even the ASA found a route to 8.8.8.8 ;o)

In my old firewall there was a factory defined default route that took care of this. Not really sure under which circumstances it would be useful NOT to route inside traffic outside, but I guess Cisco has their reasons.


Anyway, thanks for helping a n00b reach the www

Eurosigma Thu, 05/22/2014 - 05:32
User Badges:

I have the same situation but with no NAT or access rules configured.

 

How should I configure those rules?

Thank you.

jumora Thu, 05/22/2014 - 11:13
User Badges:
  • Cisco Employee,

What rules?? Sorry can you post the complete question

Eurosigma Thu, 05/22/2014 - 13:06
User Badges:

Hi jumora:

"traknerud" asks what's wrong with his config. And Jon Marshall says that is NAT rules seems right but he is missing a default static route.

I do have a static route but i don't know how should I configure NAT, and I can't see traknerud's NAT configuration. That's why I ask about it.

I attached my "show run" output in case it helps.

Attachment: 
Eurosigma Thu, 05/22/2014 - 22:53
User Badges:

Hello again:

 

Like Marvin pointed out in a separate post, I DO reach the internet, it's just pings that are not allowed through.

Thank you.

 

Actions

This Discussion

Related Content