Cisco ASA 5505 can ping gateway but can't ping internet

[badingdong]

Good day to all!

Sorry if I post this on the wrong group, I am having a bit of a problem on configuring an ASA 5505 firewall. And I scoured google but can't seem to find a specific link to my issues.

It is on a routed mode, have successfully configured inside and outside vlans. Hosts inside vlan can ping each other. Hosts on outside vlan can also ping each other. Problem is, when I am pinging 8.8.8.8, I received ????? Please see config below.

Any help greatly appreciated.

TIA!

##################

: Saved
:
ASA Version 8.4(3)
!
hostname ciscoasan
enable password bD3fGYMFeJJTATOJ encrypted
passwd 2KF1w9ErdI.2KYOU encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 description INSIDE
 nameif inside
 security-level 100
 ip address 10.10.10.2 255.255.255.0
!
interface Vlan2
 description OUTSIDE
 nameif outside
 security-level 0
 ip address 203.127.68.2 255.255.255.240
!
ftp mode passive
object network obj_any
 subnet 0.0.0.0 0.0.0.0
access-list outside_access_in extended permit ip any any
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network obj_any
 nat (inside,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 203.127.68.1 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
http server enable
http 10.10.10.0 255.255.255.0 inside
http authentication-certificate inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh 10.10.10.0 255.255.255.0 inside
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
 anyconnect-essentials
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny  
  inspect sunrpc
  inspect xdmcp
  inspect sip  
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:6b3e0ce99eda3d2563cf9f392f8001b7
: end

[johnlloyd_13]

hi,

you can move this thread under Security > Firewalling forum to get better feedback.

could you ping 203.127.68.1?

try to connect a laptop and assign .2 and see if you can ping the ISP hop.

make sure you've got a route back to the 'inside' interface if you've got a router or another layer 3 device behind the ASA.

route inside 10.10.10.0 255.255.255.0 10.10.10.1

[Walter Astori]

Can you execute a traceroute 8.8.8.8 source Vlan2 ?

[badingdong]

first successful hop was the gateway, after that no more.

[johnlloyd_13]

hi,

how about when you just connect a laptop and assign the .2 and ping out?

i suspect an ISP/routing issue.

your config looks fine.

[badingdong]

hi johnlloyd, i was able to ping 8.8.8.8 but on a newly configured vlan, identical to the outside vlan. Will now reconfigure outside vlan to see what i missed. Thanks! =)

[badingdong]

hi johnlloyd, yes, i can ping the gateway 203.127.68.1 from outside interface. i can also ping all other public server that we have.

[rizwanr74]

Hi badingdong,

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

Remove these lines:

no nat (inside,outside) after-auto source dynamic any interface
no access-group outside_access_in in interface outside

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

If you have more inside subnets need access to internet, please make sure that you have a static route in place as shown below.

route inside 10.0.0.0 255.0.0.0 10.10.10.1

Also make sure that you have a correct DNS server is assigned on your internal hosts.

Thanks

Rizwan Rafeek

[badingdong]

hi rizwanr74, did what you told but still doesn't let me ping 8.8.8.8 Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: ????? Success rate is 0 percent (0/5) ciscoasan(config)#

[rizwanr74]

Hi badingdong,

I assume your inside is "interface Ethernet0/1" if so you assign it to vlan 1.

interface Ethernet0/1
  switchport access vlan 1

Like I mentioned before you would not need two lines to access the internet.

Let me know please.

thanks

Rizwan Rafeek

[badingdong]

Hi rizwan, I did took out those 2 lines you've mentioned. And also regarding vlan1, all of my ethernet ports are on vlan1 except for e0/0 which belongs to outside vlan2. Please see attached file for modified conf. Still can't think of the things I missed out. Still can't ping the internet using outside interface.

[Marius Gunnerud]

You are now missing your NAT statements. add the following:

object network obj_any
 nat (inside,outside) dynamic interface

So you are able to ping the ISP (203.127.68.1) from the ASA, ? I would agree with John in that this seems a lot like an ISP problem rather than a problem with your ASA.  I suggest contacting your ISP and have them check out you connection.

--

Please remember to select a correct answer and rate helpful posts

[badingdong]

Hi marius, Thanks! I added the 2 lines you've mentioned. However, still I am not able to ping 8.8.8.8 from outside interface. ISP is out of the question because I am using pfsense with ip address on the same range as my outside ip on this cisco and same default route. Internet is fine with pfsense. Sorry for the inconvenience guys.. =(

[Marius Gunnerud]

I did not expect to solve the issue, but they are needed there so that the inside clients are able to reach the internet....once that is up and running.

If you have both CLI and ASDM open (open the realtime log viewer in ASDM) and ping 8.8.8.8 from the ASA do you see anything that might indicate that the ASA is dropping the return packets?

Another thing you could try is to do a packet capture between the inside and outside interfaces, and then ping 8.8.8.8 from a PC on the inside network.  Do you see return traffick coming in the outside interface?

http://ipfield.net/2013/06/asa-packet-capture-using-cli-and-asdm-config-example/

--

Please remember to select a correct answer and rate helpful posts

[Marius Gunnerud]

Also, for the sake of trying and if you are in a position to do so, save you ASA configuration and then restart the ASA.

If that does not work, and you see traffic leaving the outside interface but see no return traffic in the packet capture, and you see no log relating to the traffic being dropped in the the realtime log viewer, I would ask your ISP to do a clear ARP for your IP (though I would not suspect you to be able to ping your ISP if this was an ARP issue).  You might also want to ask them to flap the interface that goes to your ASA on their side (shut, no shut).

When pinging from the box there should be nothing preventing the ASA from receiving a reply, or nothing configured on the ASA that will prevent the reply with your current configuration.  Meaning you have a default route configured and interface configurations seem to be correct.

--

Please remember to select a correct answer and rate helpful posts