Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Cisco ASA , Vlans and routing to Internet

Hi,

We are having troubles accesing to internet.

We have a  Cisco ASA. From outsite it is possible to ping to internet, however no  computers in vlan  are able to access. Gateway por that computer is one  of the interface in the ASA. We have add the static route 0.0.0.0  netmask 0.0.0.0 x.x.x.x is internet gateway.

It seems a routing problem but we have not much experience with routes.

Any idea? Please I would thanks your help with ideas.

We ping to internet (using ASA ping utility)  but when ping from VLAN  interfaces, no reply. Its possible to route between VLANS. the problem  is we are not able to go out internet.

The configuration file:

: Saved

: Written by enable_15 at 19:55:28.909 CEDT Sat Jun 2 2012

!

ASA Version 8.2(5)

!

hostname ciscoasa1

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 10.1.140.2 COMPANYS-QUES description COMPANYS-QUES

name 70.16.56.43 COMPAN-office-Router-Px description COMPAN-office-Router-Px

name 85.200.150.122 COMPAN-office-Router-VPN description COMPAN-office-Router-VPN

name 202.80.116.150 USA-IP-office01 description USA-IP-office01

name 80.94.1.229 USA-IP-office02 description USA-IP-office02

name 81.184.4.124 USA-IP-office03 description USA-IP-office03

!

interface Ethernet0/0

description Outside Provider

nameif Outside

security-level 0

ip address 191.150.52.21 255.255.255.248 standby 192.120.111.190

!

interface Ethernet0/1

description Inside

no nameif

no security-level

no ip address

!

interface Ethernet0/1.10

description Administracion

vlan 10

nameif VLAN10

security-level 100

ip address 10.1.10.254 255.255.255.0

!

interface Ethernet0/1.100

description SQL

vlan 110

nameif VLAN110

security-level 100

ip address 10.1.110.254 255.255.255.0

!

interface Ethernet0/1.120

description SCI

vlan 120

nameif VLAN120

security-level 100

ip address 10.1.120.254 255.255.255.0

!

interface Ethernet0/1.130

description IIS

vlan 130

nameif VLAN130

security-level 100

ip address 10.1.130.254 255.255.255.0

!

interface Ethernet0/1.140

description CX

vlan 140

nameif VLAN140

security-level 100

ip address 10.1.140.254 255.255.255.0

!

interface Ethernet0/2

description Punto a punto

nameif Punto_Punto

security-level 100

ip address 10.3.1.1 255.255.255.248

!

interface Ethernet0/3

description LAN/STATE Failover Interface

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive

clock timezone CEST 1

clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group protocol DM_INLINE_PROTOCOL_2

protocol-object ip

protocol-object icmp

object-group protocol DM_INLINE_PROTOCOL_3

protocol-object ip

protocol-object icmp

object-group network COMPAN-office

network-object host COMPAN-office-Router-Px

network-object host COMPAN-office-Router-VPN

object-group network CUSTOMER

network-object host USA-IP-office01

network-object host USA-IP-office02

network-object host USA-IP-office03

object-group network COMPANYS-Primary

network-object 10.1.0.0 255.255.0.0

object-group protocol DM_INLINE_PROTOCOL_1

protocol-object ip

protocol-object icmp

object-group service DM_INLINE_SERVICE_1

service-object ip

service-object icmp

service-object tcp eq 59102

access-list Inside_nat0_outbound extended permit ip any 10.40.0.0 255.255.255.0

access-list Inside_nat0_outbound extended permit ip any 10.1.10.208 255.255.255.240

access-list Inside_access_in remark Red MTS Primary

access-list Inside_access_in extended permit object-group DM_INLINE_SERVICE_1 object-group COMPANYS-Primary any

access-list Outside_access_in extended permit object-group DM_INLINE_PROTOCOL_3 any any

access-list Inside_access_in_1 extended permit object-group DM_INLINE_PROTOCOL_2 any any

access-list Outside_access_in_1 remark RED CUSTOMER

access-list Outside_access_in_1 extended permit tcp object-group CUSTOMER host COMPANYS-QUES eq 59102

access-list Outside_access_in_1 remark Red MT office

access-list Outside_access_in_1 extended permit object-group DM_INLINE_PROTOCOL_1 object-group COMPAN-office any

access-list Outside_access_in_1 remark Permitir echo PING

access-list Outside_access_in_1 extended permit icmp any any

access-list Outside_access_in_1 remark Regla de pruebas, QUITAR EN PRODUCCION

access-list Outside_access_in_1 extended permit ip any any

access-list Splilt_Tunnel_list standard permit 10.1.0.0 255.255.0.0

access-list Splilt_Tunnel_list remark Red Interna 10.1.10.0 /16

pager lines 24

logging enable

logging asdm informational

mtu Outside 1500

mtu VLAN10 1500

mtu VLAN110 1500

mtu VLAN120 1500

mtu VLAN130 1500

mtu VLAN140 1500

mtu Punto_Punto 1500

mtu management 1500

ip local pool Inside_pool 10.1.10.215-10.1.10.220 mask 255.255.0.0

ip local pool MYCOMPAN_domain 10.40.0.0-10.40.0.255 mask 255.255.255.0

ip local pool VPN_LAN 10.1.200.1-10.1.200.254 mask 255.255.0.0

ipv6 access-list VLAN10_access_ipv6_in permit ip any any

failover

failover lan unit secondary

failover lan interface HA Ethernet0/3

failover polltime unit msec 200 holdtime msec 800

failover link HA Ethernet0/3

failover interface ip HA 192.168.21.1 255.255.255.252 standby 192.168.21.2

icmp unreachable rate-limit 1 burst-size 1

icmp permit any Outside

no asdm history enable

arp timeout 14400

global (Outside) 101 interface

nat (management) 101 0.0.0.0 0.0.0.0

access-group Outside_access_in in interface Outside control-plane

access-group Outside_access_in_1 in interface Outside

access-group VLAN10_access_ipv6_in in interface VLAN10

route Outside 0.0.0.0 0.0.0.0 190.130.150.192 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-reco

rd DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
http 0.0.0.0 0.0.0.0 Outside
http 10.1.10.0 255.255.255.0 VLAN10
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto  dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set  ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5  ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA  ESP-DES-MD5
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside_map interface Outside
crypto map Inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto isakmp enable Outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto isakmp policy 65535
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp server 178.255.47.55
webvpn
enable Outside
group-policy DfltGrpPolicy attributes
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Splilt_Tunnel_list
group-policy MYCOMPANPROVIDERMAIN internal
group-policy MYCOMPANPROVIDERMAIN attributes
vpn-tunnel-protocol IPSec svc webvpn
split-tunnel-policy tunnelspecified
split-tunnel-network-list value Splilt_Tunnel_list
group-policy MYCOMPAN internal
group-policy MYCOMPAN attributes
vpn-tunnel-protocol IPSec svc webvpn
username testuser password MNpDoVHX8eTwHuKw encrypted privilege 15
username testuser attributes
service-type remote-access
tunnel-group MYCOMPAN type remote-access
tunnel-group MYCOMPAN general-attributes
address-pool MYCOMPAN_domain
default-group-policy MYCOMPAN
tunnel-group MYCOMPAN ipsec-attributes
pre-shared-key *
tunnel-group MYCOMPANPROVIDERMAIN type remote-access
tunnel-group MYCOMPANPROVIDERMAIN general-attributes
address-pool Inside_pool
default-group-policy MYCOMPANPROVIDERMAIN
tunnel-group MYCOMPANPROVIDERMAIN ipsec-attributes
pre-shared-key *
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny 
  inspect sunrpc
  inspect xdmcp
  inspect sip 
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:61416243047a24f990be949ff72754d0
3 ACCEPTED SOLUTIONS

Accepted Solutions

Re: Cisco ASA , Vlans and routing to Internet

How is your routing setup? I'm assuming your users are most likely connected to switches is this correct? If true, from the switches how are they connected to the ASA? It looks like all routing is going through the ASA, so I could assume it's Layer 2 all the way up to your ASA. I would make sure your hosts are on the proper VLAN, and they are getting the correct default gateway from their DHCP server. Also, if you have trunks between switches, make sure the appropriate vlans are allowed to pass. Also, make sure DNS is configured correctly, I have no idea if your pinging by IP or hostname when you attempt to ping outside.

These are just a  few things to look at.

New Member

Re: Cisco ASA , Vlans and routing to Internet

you do not have static nat or dynamic nat staments there mate. that is why none of your internal ip addresses are able to translate and go out. you need a nat statement like below for one of your local hosts to be translated to a public ip

nat (inside, outside) source static

this post is in the wrong section btw

Re: Cisco ASA , Vlans and routing to Internet

Can't believe I missed that Mikull LOL...

global (Outside) 101 interface

nat (management) 101 0.0.0.0 0.0.0.0

This seems to be your only NAT statements. You can run the following commands on the ASA to check for NAT.

'show run nat'

'show run global'

It looks liek you have a PAT statement setup for your outside  interface IP, all you need to do is configure some NAT statements.

Example:

nat (inside) 101

Make sure to add the 101 so it matches will your PAT statement.

LOL, can't believe I missed the NAT statements...........

6 REPLIES

Re: Cisco ASA , Vlans and routing to Internet

How is your routing setup? I'm assuming your users are most likely connected to switches is this correct? If true, from the switches how are they connected to the ASA? It looks like all routing is going through the ASA, so I could assume it's Layer 2 all the way up to your ASA. I would make sure your hosts are on the proper VLAN, and they are getting the correct default gateway from their DHCP server. Also, if you have trunks between switches, make sure the appropriate vlans are allowed to pass. Also, make sure DNS is configured correctly, I have no idea if your pinging by IP or hostname when you attempt to ping outside.

These are just a  few things to look at.

New Member

Re: Cisco ASA , Vlans and routing to Internet

I make a mistake with the botton of accepted answer. It does not matter.
For your information, we have  ASA working as router and Firewall roles and connected to the ASA a swich in trunk mode in the LAN. The clients in the internal network are able to ping and reach all VLANs (in our case we allow this) and all host, therefore the ASA is routing between VLANs right, the problem is the access to internet. In ASA, we have a static route pointing to default gateway of the Internet provider, but VLANs are not able to reach internet.

New Member

Re: Cisco ASA , Vlans and routing to Internet

you do not have static nat or dynamic nat staments there mate. that is why none of your internal ip addresses are able to translate and go out. you need a nat statement like below for one of your local hosts to be translated to a public ip

nat (inside, outside) source static

this post is in the wrong section btw

Re: Cisco ASA , Vlans and routing to Internet

Can't believe I missed that Mikull LOL...

global (Outside) 101 interface

nat (management) 101 0.0.0.0 0.0.0.0

This seems to be your only NAT statements. You can run the following commands on the ASA to check for NAT.

'show run nat'

'show run global'

It looks liek you have a PAT statement setup for your outside  interface IP, all you need to do is configure some NAT statements.

Example:

nat (inside) 101

Make sure to add the 101 so it matches will your PAT statement.

LOL, can't believe I missed the NAT statements...........

New Member

Cisco ASA , Vlans and routing to Internet

haha.. happens to the best of us sometimes

looking with a security perspective I would definifey drop the pat statement. gives you more granular control on who would be able to access the internet from your internal vlan's

if you have a pool of public's, assign one public ip to each vlan and do static nat's to check what your internal vlan guys are accessing

New Member

Cisco ASA , Vlans and routing to Internet

Sorry for not responding. Workload is being very hard to support.

Thanks you all. Yeahhhh!   It was a great solution, and we were guided solved the problem.

We missed NAT entries in our configuration files.

thanks again.

Best Regards,

John

1290
Views
0
Helpful
6
Replies
CreatePlease to create content