Solved: Re: Installing ASA5505 on my home network

John Bachman · ‎07-18-2013

Hi, Just purchased a ASA5505 for my CCNA Security

I want to use one of the interface (the outside interface VLAN2 port eth0/0) to connect to my home network to be able to mange it and use ADSM form my PC. This eth0/0 is set for DHCP on the ASA and I optain IP 192.168.30.151 from my Cisco e4200 home router. Now, I can not https to acess it. I can only access it thru VLAN1 (the inside VLAN) thru a closed network.

How can I connect the VLAN2 port 0 interface to my network ? I can ping it, but can not https into it. Do I need to setup DMZ or Application/gamig port ?

Thank you.

Jouni Forss · ‎07-18-2013

Hi,

You probably have allowed access to the ASA through the "outside" interface

You might need the following configuration command

http 192.168.30.0 255.255.255.0 outside

Provided that is your network on the "outside"

Easy way to confirm this would be to see the configuration. But since you can access ASDM from the other interface of the ASA then I would presume the problem is missing the above command.

- Jouni

View solution in original post

Marvin Rhoads · ‎07-18-2013

Did you try adding the "ssl encryption des-sha1 aes256-sha1"?

Does anything happen on the ASA's ASDM log as you try to connect?

View solution in original post

Jouni Forss · ‎07-18-2013

Hi,

You probably have allowed access to the ASA through the "outside" interface

You might need the following configuration command

http 192.168.30.0 255.255.255.0 outside

Provided that is your network on the "outside"

Easy way to confirm this would be to see the configuration. But since you can access ASDM from the other interface of the ASA then I would presume the problem is missing the above command.

- Jouni

John Bachman · ‎07-18-2013

Thank you

I changed it from inside to outside, I still do not have access

My IP for VLAN2 is 192.168.0.163 255.255.255.0 (static)

I have :

http server enable

http 192.168.0.0 255.255.255.0 outside

When I ping 192.168.0.163 from my pc on 192.168.0.139 it pings OK

but when I https://192.168.0.163 to access the server page, it fails....

johnlloyd_13 · ‎07-18-2013

hi,

from which side is your PC connected, behind the 5505 or e4200?

could you kindly post show run?

Marvin Rhoads · ‎07-18-2013

Can you confirm that ASDM is working on VLAN 1? You aid you can access the ASA but didn't say with what method.

Have you confirmed that the address responding to 192.168.0.163 is the ASA? (Compare ASA's "show interface" command output with "arp -a" on your PC.)

When you browse to the ASA via VLAN 2 and get a failure, what kind of failure is it? Just a blank page?

John Bachman · ‎07-18-2013

ASDM working from VLAN1. But I need if on VLAN2 as this is my outside interface towards Internet/home network.

The VLAN2 ip is 192.168.0.163 255.255.255.0

I can ping 192.168.0.163 from my PC at 192.168.0.139

When I hit the enter key after https://192.168.0.163, it goes directly to dead page.

Marvin Rhoads · ‎07-18-2013

I asked about verifying the MAC address in the event of an address conflict. It's a shot in the dark but something else could be responding to the pings.

When you try to access via VLAN 2 does the ASA report anything in its ASDM log (assuming you have informational or higher ASDM logging turned on)?

John Bachman · ‎07-18-2013

It is on the e4200 side, (the home network) but I disconnected it and connected the PC directly on the ASA with a cross-over cable for now.

When I ping 192.168.0.163 from my pc on 192.168.0.139 it pings OK

but when I https://192.168.0.163 to access the server page, it fails....

John Bachman · ‎07-18-2013

asa5505# sh run
: Saved
:
ASA Version 9.1(2)
!
hostname asa5505
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 192.168.0.163 255.255.255.0
!
ftp mode passive
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (inside,outside) dynamic interface
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
http server enable
http 192.168.0.0 255.255.255.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.5-192.168.1.36 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:83d3c0a5f53855a92505b175db342b11
: end
asa5505#

Marvin Rhoads · ‎07-18-2013

I don't see the expected "ssl encryption des-sha1 aes256-sha1" entry in your configuration.

John Bachman · ‎07-18-2013

This is a new Asa.
All i have done is config factory default

I just want to connect it to my home network to start my CCNA security...

Sent from Cisco Technical Support iPad App

Marvin Rhoads · ‎07-18-2013

I suggested it because lack of that line is a known problem with new ASAs.

https://supportforums.cisco.com/thread/2206779

johnlloyd_13 · ‎07-18-2013

hi,

you've mentioned a different subnet/IP on your original post (192.168.30.151).

make sure both ASA and E4200 have static routes pointed at each other's subnet and enable each for ASDM.

below config on the ASA would cover the 192.168.x.x/16 subnet.

http 192.168.0.0 255.255.0.0 outside

John Bachman · ‎07-18-2013

.30 was a typo. Sorry.

Sent from Cisco Technical Support iPad App

johnlloyd_13 · ‎07-18-2013

ok, maybe you don't need static routes here.

did you reserve the ASA's IP192.168.0.163 on the E4200? on your orig post you've set E0/0 to get an IP via DHCP.

make sure it's not handed out to another host/PC.

also, your ASA has dhcpd address 192.168.1.5-192.168.1.36 inside.

i also have a E4200 at home and by default it uses the 192.168.1.0/24 subnet.

try removing this and make the E4200 act as the DHCP server.