Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

My "management" VLAN cannot connect to Internet

I am sure that it is something silly. I am pretty sure that I have it setup the same way as my other vlans. It will not connect to the Internet. I have a NAT rule for it. I have no access rules, that I am aware of that are stopping it.

VLAN5 - Cannot connect to Internet or any websites. 10.37.0.0 /24

I just use this to mess around at home but if someone could help or tell me where I am going wrong that would be greatly appreciated.

ASA Version 9.2(2)4
!
hostname aquaman
domain-name batcave.local
enable password 8Ry2YjIyt7RRXU24 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 208.67.222.222 OpenDNS1
name 208.67.220.220 OpenDNS2
name 208.67.222.220 OpenDNS3
name 208.67.220.222 OpenDNS4
name 10.37.1.101 spiderman
name 10.37.1.99 green-arrow
name 10.37.3.0 vpn-network
name 10.37.1.25 ironman
name 10.37.1.20 the-flash
ip local pool Home_DHCP_VPN 10.37.3.130-10.37.3.160 mask 255.255.255.0
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
 switchport trunk allowed vlan 1,3-5
 switchport trunk native vlan 1
 switchport mode trunk
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif home
 security-level 100
 ip address 10.37.1.1 255.255.255.0
 dhcprelay server 10.37.1.10
 dhcprelay server 10.37.1.9
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
interface Vlan3
 nameif guest
 security-level 50
 ip address 10.37.2.254 255.255.255.0
 dhcprelay information trusted
!
interface Vlan4
 nameif test
 security-level 25
 ip address 192.168.37.254 255.255.255.0
 dhcprelay information trusted
!
interface Vlan5
 nameif mgt
 security-level 100
 ip address 10.37.0.1 255.255.255.0
 dhcprelay information trusted
!
!
time-range guest-permit
 periodic weekdays 8:00 to 21:00
!
boot system disk0:/asa922-4-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup outside
dns server-group DefaultDNS
 name-server OpenDNS1
 name-server OpenDNS2
 name-server OpenDNS3
 name-server OpenDNS4
 domain-name batcave.local
same-security-traffic permit inter-interface
object network OpenDNS2
 host 208.67.220.220
object network OpenDNS4
 host 208.67.220.222
object network OpenDNS3
 host 208.67.222.220
object network OpenDNS1
 host 208.67.222.222
object network vpn-network
 subnet 10.37.3.0 255.255.255.0
object network green-arrow_rdp
 host 10.37.1.99
object network spiderman_vnc
 host 10.37.1.101
object network ironman_smtp
 host 10.37.1.30
object network the-flash
 host 10.37.1.20
object network work_ip
 host 64.80.36.218
object network the-hulk_http
 host 10.37.1.15
object network spiderman
 host 10.37.1.101
object network the-hulk_ftp
 host 10.37.1.15
object network the-hulk
 host 10.37.1.15
object network cyclops
 host 10.37.1.9
object network daredevil
 host 10.37.1.10
object network google-dns-a
 host 8.8.8.8
object network google-dns-b
 host 8.8.4.4
object network ironman
 host 10.37.1.30
object network wiki
 host 10.37.1.25
object network the-flash_tftp
 host 10.37.1.20
object network home_network
 subnet 10.37.1.0 255.255.255.0
object network guest_network
 subnet 10.37.2.0 255.255.255.0
object network test_network
 subnet 192.168.37.0 255.255.255.0
object network mgt_network
 subnet 10.37.0.0 255.255.255.0
object network mxsrv1.spamgateway.comodo.com
 host 178.33.199.65
object network mxsrv2.spamgateway.comodo.com
 host 178.33.199.66
object network mxsrv3.spamgateway.comodo.com
 host 178.33.199.69
object network ironman_pop
 host 10.37.1.30
object network the-hulk_ssh
 host 10.37.1.15
object network wiki_http
 host 10.37.1.25
object network BruceCamera
 host 10.37.1.65
object network mgt
 subnet 10.37.0.0 255.255.255.0
object network mangt_network
 subnet 10.37.0.0 255.255.255.0
object-group network obj_any
object-group network OpenDNS_Servers
 network-object object OpenDNS2
 network-object object OpenDNS4
 network-object object OpenDNS3
 network-object object OpenDNS1
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service vnc tcp
 port-object eq 5900
object-group service rdp tcp
 port-object eq 3389
object-group network Comodo_Server
 network-object object mxsrv1.spamgateway.comodo.com
 network-object object mxsrv2.spamgateway.comodo.com
 network-object object mxsrv3.spamgateway.comodo.com
object-group network domain-controllers
 network-object object cyclops
 network-object object daredevil
object-group network google-dns
 network-object object google-dns-a
 network-object object google-dns-b
object-group network DM_INLINE_NETWORK_1
 network-object 10.37.0.0 255.255.255.0
 network-object 10.37.1.0 255.255.255.0
 network-object 192.168.37.0 255.255.255.0
object-group network DM_INLINE_NETWORK_2
 network-object 10.37.0.0 255.255.255.0
 network-object 10.37.1.0 255.255.255.0
access-list home_access_in extended permit object-group TCPUDP object-group DM_INLINE_NETWORK_2 object-group OpenDNS_Servers eq domain log disable
access-list home_access_in extended permit object-group TCPUDP object-group domain-controllers object-group google-dns eq domain log disable
access-list home_access_in extended permit object-group TCPUDP object spiderman any4 eq domain log disable
access-list home_access_in extended deny object-group TCPUDP 10.37.1.0 255.255.255.0 any4 eq domain log disable
access-list home_access_in extended permit ip 10.37.0.0 255.255.255.0 any log disable
access-list home_access_in extended permit ip any4 any4 log disable
access-list Home standard permit 10.37.0.0 255.255.255.0
access-list Home standard permit 10.37.1.0 255.255.255.0
access-list Home standard permit 10.37.2.0 255.255.255.0
access-list Home standard permit 192.168.37.0 255.255.255.0
access-list home_nat0_outbound extended permit ip object vpn-network any4
access-list guest_access_in extended permit object-group TCPUDP 10.37.2.0 255.255.255.0 object-group OpenDNS_Servers eq domain log disable
access-list guest_access_in extended deny object-group TCPUDP 10.37.2.0 255.255.255.0 any4 eq domain log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq ftp log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq telnet log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 eq ssh log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 object-group rdp log disable
access-list guest_access_in extended deny tcp 10.37.2.0 255.255.255.0 any4 object-group vnc log disable
access-list guest_access_in extended permit ip any4 any4 log disable
access-list test_access_in extended permit object-group TCPUDP 192.168.37.0 255.255.255.0 object-group google-dns eq domain log disable
access-list test_access_in extended deny object-group TCPUDP 192.168.37.0 255.255.255.0 any4 eq domain log disable
access-list test_access_in extended permit ip any4 any4 log disable
access-list outside_access_in extended permit tcp any4 object spiderman_vnc eq 5900 log disable
access-list outside_access_in extended permit tcp any4 object green-arrow_rdp eq 3389 log disable
access-list outside_access_in extended permit tcp any4 object the-hulk_http eq www log disable
access-list outside_access_in extended permit tcp any4 object the-hulk_ftp eq ftp log disable
access-list outside_access_in extended permit udp any4 object the-flash_tftp eq tftp log disable inactive
access-list outside_access_in extended permit tcp object-group Comodo_Server object ironman_smtp eq smtp log disable inactive
access-list outside_access_in extended permit tcp any object the-hulk_ssh eq ssh log disable
access-list outside_access_in extended permit tcp any4 object wiki_http eq 8080 log disable inactive
access-list outside_access_in extended permit tcp any4 object ironman_pop eq pop3 log disable inactive
access-list outside_access_in extended permit icmp any4 object-group DM_INLINE_NETWORK_1 log disable
pager lines 24
logging enable
logging timestamp
logging monitor informational
logging trap warnings
logging asdm informational
logging device-id hostname
logging host home the-flash
logging ftp-server 10.37.1.15 Cisco aquaman WhyAquaman
mtu home 1500
mtu outside 1500
mtu guest 1500
mtu test 1500
mtu mgt 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit 10.37.1.0 255.255.255.0 home
icmp permit host 64.80.36.218 echo outside
icmp deny any echo outside
icmp deny any guest
icmp permit 10.37.0.0 255.255.255.0 mgt
asdm image disk0:/asdm-731.bin
asdm location green-arrow 255.255.255.255 home
asdm location ironman 255.255.255.255 home
asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (home,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Home
nat (home,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Home to VPN
nat (guest,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Guest
nat (guest,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Guest to VPN
nat (test,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to Test
nat (test,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description Test to VPN
nat (mgt,any) source static vpn-network vpn-network no-proxy-arp route-lookup description VPN to MGT
nat (mgt,outside) source static any any destination static vpn-network vpn-network no-proxy-arp route-lookup description MGT to VPN
nat (mgt,any) source static mgt_network mgt_network no-proxy-arp route-lookup
!
object network green-arrow_rdp
 nat (home,outside) static interface service tcp 3389 3389
object network spiderman_vnc
 nat (home,outside) static interface service tcp 5900 5900
object network ironman_smtp
 nat (home,outside) static interface service tcp smtp smtp
object network the-hulk_http
 nat (any,outside) static interface service tcp www www
object network the-hulk_ftp
 nat (any,outside) static interface service tcp ftp ftp
object network the-flash_tftp
 nat (any,outside) static interface service udp tftp tftp
object network home_network
 nat (home,outside) dynamic interface
object network guest_network
 nat (guest,outside) dynamic interface
object network test_network
 nat (test,outside) dynamic interface
object network the-hulk_ssh
 nat (any,outside) static interface service tcp ssh 3722
object network wiki_http
 nat (any,outside) static interface service tcp www 8080
object network mangt_network
 nat (mgt,outside) dynamic interface
access-group home_access_in in interface home
access-group outside_access_in in interface outside
access-group guest_access_in in interface guest
access-group test_access_in in interface test
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server BATCAVE protocol ldap
aaa-server BATCAVE (home) host 10.37.1.10
 ldap-base-dn OU=Users,OU=Home,DC=batcave,DC=local
 ldap-naming-attribute sAMAccountName
 ldap-login-password ci$coLD@P@ccount!
 ldap-login-dn CN=Cisco LDAP Account,OU=Service Accounts,DC=batcave,DC=local
 server-type microsoft
aaa-server BATCAVE (home) host 10.37.1.9
 ldap-base-dn OU=Users,OU=Home,DC=batcave,DC=local
 ldap-naming-attribute sAMAccountName
 ldap-login-password ci$coLD@P@ccount!
 ldap-login-dn CN=Cisco LDAP Account,OU=Service Accounts,DC=batcave,DC=local
 server-type microsoft
no user-identity enable
user-identity default-domain LOCAL
aaa authentication http console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
http server enable 3737
http 10.37.1.0 255.255.255.0 home
http 64.80.36.218 255.255.255.255 outside
http 192.168.37.0 255.255.255.0 test
http 10.37.0.0 255.255.255.0 mgt
http redirect home 80
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
crypto ca server
 shutdown
 issuer-name CN=vpn.endofinternet.net
telnet timeout 5
ssh stricthostkeycheck
ssh spiderman 255.255.255.255 home
ssh green-arrow 255.255.255.255 home
ssh 10.37.1.100 255.255.255.255 home
ssh the-flash 255.255.255.255 home
ssh 64.80.36.218 255.255.255.255 outside
ssh 192.168.37.0 255.255.255.0 test
ssh 10.37.0.0 255.255.255.0 mgt
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 10
vpn-addr-assign local reuse-delay 5

dhcpd auto_config outside
!
dhcprelay server 10.37.1.9 home
dhcprelay server 10.37.1.10 home
dhcprelay enable guest
dhcprelay enable test
dhcprelay enable mgt
dhcprelay setroute guest
dhcprelay setroute test
dhcprelay setroute mgt
dhcprelay timeout 60
dhcprelay information trust-all
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 10.37.1.9 source home
ntp server 10.37.1.10 source home prefer
tftp-server home the-flash ASA-aquaman-config
webvpn
 enable home
 enable outside
 enable test
 enable mgt
 anyconnect image disk0:/anyconnect-win-3.1.05160-k9.pkg 2
 anyconnect enable
 tunnel-group-list enable
group-policy DfltGrpPolicy attributes
 dns-server value 10.37.1.10 10.37.1.9
 vpn-simultaneous-logins 1
 vpn-idle-timeout none
 vpn-tunnel-protocol ikev1 l2tp-ipsec ssl-client ssl-clientless
 split-tunnel-policy tunnelspecified
 split-tunnel-network-list value Home
 default-domain value batcave.local
 msie-proxy method no-proxy
 msie-proxy lockdown disable
 address-pools value Home_DHCP_VPN
group-policy GroupPolicy_HomeVPN internal
group-policy GroupPolicy_HomeVPN attributes
 wins-server none
 dns-server value 10.37.1.10 10.37.1.9
 vpn-tunnel-protocol ssl-client
 default-domain value batcave.local
 split-tunnel-all-dns enable
username jared password YlQ4V6UbWiR/Dfov encrypted privilege 15
username heather password k.n80rwHaJIBfsIb encrypted
username heather attributes
 service-type remote-access
username root password Tz23FNHAkYSJufHD encrypted privilege 15
tunnel-group HomeVPN type remote-access
tunnel-group HomeVPN general-attributes
 address-pool Home_DHCP_VPN
 authentication-server-group BATCAVE LOCAL
 default-group-policy GroupPolicy_HomeVPN
tunnel-group HomeVPN webvpn-attributes
 group-alias HomeVPN enable
!
class-map guest-class
 match any
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map guest-policy
 class guest-class
  police input 8000000 4000
  police output 8000 1500
!
service-policy guest-policy interface guest
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:0a10e716f6b87c443b80655f7ff88aa3

Everyone's tags (1)
6 REPLIES
Cisco Employee

Hi,This is the issue:-nat

Hi,

This is the issue:-

nat (mgt,any) source static mgt_network mgt_network no-proxy-arp route-lookup

As you would need to NAT the traffic out to the internet , you would have to remove the NAT and apply the Interface PAT which you already have.

object network mangt_network
 nat (mgt,outside) dynamic interface

Also , apply fixup protocol icmp to allow PING traffic through the ASA device for testing.

Thanks and Regards,

Vibhor Amrodia

VIP Green

fixup protocol icmp is a PIX

fixup protocol icmp is a PIX command and will not work on the ASA9.2.

You would need to ad inspect icmp under the global policy.

 

--

Please remember to rate and select a correct answer
Cisco Employee

Hi Marius,Thank you for your

Hi Marius,

Thank you for your reply on this post.

fixup protocol icmp will still be available on the newest version of the ASA device.

This will automatically convert the MPF configuration on the ASA device.

This is a shortcut on the ASA device rather than configuring the complete MPF configuration.

ciscoasa(config)# sh ver | in Version
Cisco Adaptive Security Appliance Software Version 9.3(1)
ciscoasa(config)# fixup protocol icmp
INFO: converting 'fixup protocol icmp ' to MPF commands

 

Thanks and Regards,

Vibhor Amrodia

VIP Green

Interesting!!!  Is this new

Interesting!!!  Is this new in 9.3?

 

--

Please remember to rate and select a correct answer
Cisco Employee

Hi Marius,This has always

Hi Marius,

This has always been there on the ASA device. :)

Thanks and Regards,

Vibhor Amrodia

VIP Green

Hmmm, because I have always

Hmmm, because I have always gotten an error when I put this command in. Though I have only tried to use it once on a 8.4

--

Please remember to rate and select a correct answer
135
Views
0
Helpful
6
Replies
CreatePlease to create content