asa-5512-x cant connect to internet from inside lan, but ASA device connects

[davedoggydogg]

this is like a test network, i have it on the most basic settings i can as i am learning. i have a asa 5512 device.  I used the wizard for the initial setup pre 8.3 and was able to get it to work on my other ASA device. But i see alot of things changed since 8.3 and i am now using this newer device with 9.1.  The asa 5512 device can ping the outside and dns works, but i cant get my inside lan to communicate with the internet. Can someone help me?

Result of the command: "Show running-config"

: Saved
:
ASA Version 9.1(2) 
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute 
!
interface GigabitEthernet0/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 192.168.110.1 255.255.255.0 
!
ftp mode passive
dns domain-lookup management
dns domain-lookup outside
dns server-group DefaultDNS
 name-server 206.13.29.12
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
nat (management,outside) after-auto source dynamic any interface
route management 0.0.0.0 0.0.0.0 192.168.1.235 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.110.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.110.2-192.168.110.254 management
dhcpd dns 206.13.29.12 interface management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
Cryptochecksum:1270034b5cd9efe8f02d252068c3efdd
: end

[Jouni Forss · Accepted solution]

Hi,

I can see that in the above configuration the only other interface besides the interface "outside" is the interface called "management".

From what I can remember the new ASA5500-X series have the "management-only" setting under the Management0/0 interface which can not be removed. This also means that with this setting this interface can only be used to connect to the ASA for management purposes and no actual data can pass through this interface to another interface.

So you would be better off configuring one of the other physical interface as "inside" and connecting your hosts there and configuring the same type of Dynamic PAT configuration for that interface as you have done for the "management" interface.

In the original ASA5500 series you could remove the "management-only" command from the Management0/0 interface which made it a normal data interface. In the new models they added additional data interfaces to the ASAs so I guess that was the reason (or one of them) to make the Management0/0 interface truly a management interface and nothing else.

Hope this helps :)

- Jouni

[davedoggydogg]

awesome thanks, silly me, thats exaclty what it was, i connected to port 1 and now it works fine, i just had to enable and configure port 1. i can now connect to the iternet.  now only problem i have is i cant manage the asa  device using ASDM from port 1 ( port 1 is 192.168.200.1) . is there anyway to manage it from this inside port so i dont have to keep unplugging everytime i want to manage the device?

here is the new config: (i know i setup DHCP wrong, i will play with it later)

ciscoasa# Show running-config
: Saved
:
ASA Version 9.1(2)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface GigabitEthernet0/1
 nameif iinside
 security-level 100
 ip address 192.168.200.1 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif management
 security-level 100
 ip address 192.168.110.1 255.255.255.0
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
pager lines 24
logging asdm informational
mtu management 1500
mtu iinside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
nat (iinside,outside) after-auto source dynamic any interface
route iinside 0.0.0.0 0.0.0.0 192.168.1.235 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.110.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd address 192.168.110.2-192.168.110.254 management
dhcpd enable management
!
dhcpd address 192.168.200.20-192.168.200.100 iinside
dhcpd dns 206.13.29.12 interface iinside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:1277eb4a1fb4b6d6cf168517d905d5d1

[Jouni Forss]

Hi,

In this case you should simply add a "http" command using the subnet behind "inside" interface.

It would look like this

http 192.168.200.0 255.255.255.0 inside

This should be all that is needed. It tells the ASA from which source address the ASA can be managed and also behind which interface that source address is located at.

Hope this helps :)

- Jouni

[davedoggydogg]

sorry for me being such a newbie, im learning. thanks for your patience with me. I tried to type that command in the console and i got the following error, im not sure if im doing it right. 

ciscoasa#
ciscoasa#
ciscoasa# config t
ciscoasa(config)# http server enable
ciscoasa(config)# http 192.168.200.0 255.255.255.0 inside
                                                    ^
ERROR: % Invalid input detected at '^' marker.

[Jouni Forss]

Hi,

Seems you have actually named your new interface "iinside" (2x "i" -letters)

So you should actually use

http 192.168.200.0 255.255.255.0 iinside

Or change the interface name to "inside"

- Jouni

[davedoggydogg]

ROFL, wow, im embarrassed. it works now i can now access everything. thanks a million!!