Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Not able to ping or access Internet through asa 5505 firewall

Hi,

I am new to ASA 5505 firewall. I just configured what I learnt from the internet. However I am not able to access internet.

I can ping default gateway from any host, but I cannot ping Outside interface or beyond that.

Please see the configuraion below and help me to fix the issue.

Thanks,

Sivakumar

=================================================================================

ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 63.193.24.33 255.255.255.248
!
interface Vlan3
no forward interface Vlan1
nameif dmz
security-level 50
ip address 10.10.10.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 3
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service DM_INLINE_TCP_1 tcp
port-object eq domain
port-object eq ftp
port-object eq www
port-object eq https
port-object eq nntp
port-object eq pop3
object-group icmp-type DM_INLINE_ICMP_1
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
icmp-object timestamp-request
object-group icmp-type DM_INLINE_ICMP_2
icmp-object echo
icmp-object echo-reply
icmp-object information-reply
icmp-object time-exceeded
icmp-object timestamp-reply
icmp-object timestamp-request
access-list inside_access_in extended permit tcp any any object-group DM_INLINE_
TCP_1
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit icmp any any object-group DM_INLINE
_ICMP_1
access-list outside_access_in extended permit icmp any any object-group DM_INLIN
E_ICMP_2
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 192.168.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:ef1cdf5444b6d88b8ccb42f19a3426f4
: end

4 REPLIES
Cisco Employee

Re: Not able to ping or access Internet through asa 5505 firewal

1) Default gateway on the ASA is set incorrectly. The ASA outside interface ip is 63.193.24.33, and currently the default gateway is configured to be:

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

Pls change it to the next hop of your ISP address (should be something in the 63.193.24.32/29 subnet):

route outside 0.0.0.0 0.0.0.0 63.193.24.x

2) To be able to ping through the ASA, pls add the following:

policy-map global_policy
      class inspection_default  

          inspect icmp

You can't ping the ASA outside interface ip from the inside network. It's not allowed by default.

Hope that helps.

New Member

Re: Not able to ping or access Internet through asa 5505 firewal

Thanks for the reply.

I have changed as per your suggestions, still I am not able to ping 63.193.24.38 which is the ISP router interface. Any more suggestions? Thanks.

Here is the current configuration.

ASA Version 7.2(4)
!
hostname ciscoasa
domain-name default.domain.invalid
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 63.193.24.33 255.255.255.248
!
interface Vlan3
no forward interface Vlan1
nameif dmz
security-level 50
ip address 10.10.10.1 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
switchport access vlan 3
!
ftp mode passive
dns server-group DefaultDNS
domain-name default.domain.invalid
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service DM_INLINE_TCP_1 tcp
port-object eq domain
port-object eq ftp
port-object eq www
port-object eq https
port-object eq nntp
port-object eq pop3
object-group icmp-type DM_INLINE_ICMP_1
icmp-object echo
icmp-object echo-reply
icmp-object time-exceeded
icmp-object timestamp-request
object-group icmp-type DM_INLINE_ICMP_2
icmp-object echo
icmp-object echo-reply
icmp-object information-reply
icmp-object time-exceeded
icmp-object timestamp-reply
icmp-object timestamp-request
access-list inside_access_in extended permit tcp any any object-group DM_INLINE_
TCP_1
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit icmp any any object-group DM_INLINE
_ICMP_1
access-list outside_access_in extended permit icmp any any object-group DM_INLIN
E_ICMP_2
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 63.193.24.38 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.33 inside
dhcpd enable inside
!

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect icmp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:02442be367c4f2b89f67a644240bf2e1
: end

New Member

Re: Not able to ping or access Internet through asa 5505 firewal

Hi

Please confirm if you can ping next hop (ISP Router) from ASA ; you would need 'icmp permit any outside" on ASA.Also try to ping 4.2.2.2 which is Global DNS Server from ASA and let us know the results .

Cisco Employee

Re: Not able to ping or access Internet through asa 5505 firewal

Pls issue "clear xlate" and "clear arp" on the ASA firewall, and test again.

5926
Views
0
Helpful
4
Replies
CreatePlease to create content