I'm trying to figure out how to do a basic setup of our new ASA 5515x in a manner that will allow clients on the inside to access the internet.
I know the topic has been covered before in many post here, but I've read them all (all I could find anyway) tested their accepted solutions but without luck.
But given my ASA experience, which is zero, this could be my own fault.
I think the problem might be caused by the fact that internet is two hops away. The ASA is on a segment, which shares internet access with six other networks. So we got a NAT over NAT situation here. But this did not prevent our old linux based firewall from reaching the internet, so the obstacle should be possible to overcome.
The setup I'm trying to make work is as follows:
External IP XX.XX.XX.XX
ISP router - 192.168.3.1 (LAN side)
ASA5515x - 192.168.3.6 outside / 192.168.0.1 inside / 192.168.1.1 managment
The question is how to give clients on the inside of the ASA access to the internet in this situation?
I followed the setup wizard (yes, I'm using ASDM) to get the basics in place. No luck.
After reading about other ASA owners without internet I found a Cisco guide on how to give two internal networks internet access. Followed half the guide, since I only have one net on the inside. (Basicly all I did was create i new NAT rule to NAT all inside IPs when going outside). Still no internet, but after this I could ping the ISP router from clients inside which was a great improvement. Pinging 184.108.40.206 or 220.127.116.11 is however always failing.
I also experimented with ping and trace in ADSM. No rute to host is always the result when using 18.104.22.168. Using 192.168.3.1 will however work in one direction. I did notice that some traffic is blocked by ACL, but I'm not sure that is a problem. The ASA is in factory setting when it comes to access rules.
Any help or advice is very very welcome!
It sounds like you have NAT setup okay. What you need though is a default route on your ASA so it knows where to send internet packets to. Sorry i don't use ADSM but on the command line it would be -
route outside 0.0.0.0 0.0.0.0 192.168.3.1