Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Initial Cisco ASA 5510 Config

Fair warning, I'm a but of a noob so please bear with me. I'm trying to set up a new ASA 5510. I have a pretty simple set up with one /24 on the inside NATed to a DHCP address on the outside. Everything on the inside works and I can ping the outside interface from external devices. No matter what I do I can't get anything internal to route across the border to the outside and back. To try and eliminate ACL issues as a possibility I added permit any any rules to the incoming access lists on the inside and outside interfaces. I'd appreciate any help I can get. Here's the sh run.

: Saved

:

ASA Version 8.4(3)

!

hostname gateway

domain-name xxx.local

enable password xxx encrypted

passwd xxx encrypted

names

!

interface Ethernet0/0

nameif outside

security-level 0

ip address dhcp setroute

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 10.x.x.x 255.255.255.0

!

interface Ethernet0/2

shutdown

no nameif

no security-level

no ip address

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive

dns domain-lookup inside

dns server-group DefaultDNS

name-server 10.x.x.x

domain-name xxx.local

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object network inside-network

subnet 10.x.x.x 255.255.255.0

object-group protocol TCPUDP

protocol-object udp

protocol-object tcp

access-list outside_access_in extended permit ip any any

access-list inside_access_in extended permit ip any any

pager lines 24

logging enable

logging buffered informational

logging asdm informational

mtu management 1500

mtu inside 1500

mtu outside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

no asdm history enable

arp timeout 14400

!

object network inside-network

nat (any,outside) dynamic interface

access-group inside_access_in in interface inside

access-group outside_access_in in interface outside

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 management

http 10.x.x.x 255.255.255.0 inside

http authentication-certificate management

http authentication-certificate inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 management

ssh 10.x.x.x 255.255.255.0 inside

ssh timeout 5

ssh version 2

console timeout 0

dhcp-client client-id interface outside

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

username xxx password xxx encrypted

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:fe19874e18fe7107948eb0ada6240bc2

: end

no asdm history enable

Message was edited by: Brendan ODonnell for spelling

Everyone's tags (1)
7 REPLIES
New Member

Initial Cisco ASA 5510 Config

I found something curious, though I'm not sure it helps. When I plug the outside drop directly into my laptop I get the following routes:

Destination     Gateway         Genmask         Flags Metric Ref    Use Iface

default         10.42.45.46     0.0.0.0         UG    0      0        0 eth0

10.42.45.46     *               255.255.255.255 UH    0      0        0 eth0

link-local      *               255.255.0.0     U     1000   0        0 wlan0

192.168.111.0   *               255.255.255.0   U     2      0        0 wlan0

And I can ping the default gateway:

brendan@this:~$ ping 10.42.45.46

PING 10.42.45.46 (10.42.45.46) 56(84) bytes of data.

64 bytes from 10.42.45.46: icmp_req=1 ttl=64 time=70.7 ms

64 bytes from 10.42.45.46: icmp_req=2 ttl=64 time=73.6 ms

64 bytes from 10.42.45.46: icmp_req=3 ttl=64 time=57.2 ms

When I plug the drop into the ASA I get the same route there:

Gateway of last resort is 10.42.45.46 to network 0.0.0.0

C    10.0.1.0 255.255.255.0 is directly connected, inside

d*   0.0.0.0 0.0.0.0 [1/0] via 10.42.45.46, outside

But I can't ping the gateway:

Sending 5, 100-byte ICMP Echos to 10.42.45.46, timeout is 2 seconds:

?????

Success rate is 0 percent (0/5)

This can't be right, can it?

Initial Cisco ASA 5510 Config

Brendan,

A couple of questions:

1. Can you ping outside of the network from a host? Try pinging 4.2.2.1 from a host on the 10.0.1.0/24 network and see if you get a response.

2. If you get a response, then web traffic needs to be inspected. Add:

policy-map global_policy

class inspection_default

inspect http

3. Take your access-lists off for now; they're not needed. Everything is blocked by default from outside in, but from inside out will be passed.

Let's try these things first to see if any of it works

HTH,

John

HTH, John *** Please rate all useful posts ***
New Member

Initial Cisco ASA 5510 Config

John,

Thanks so much for the quick response.

1. I can't ping anything on the outside from any inside hosts. Running a debug icmp trace before shows me this:

ICMP echo request from inside:10.0.1.x to outside:4.2.2.1 ID=2618 seq=1 len=56

ICMP echo request translating inside:10.0.1.x to outside:x.x.x.x

ICMP echo request from inside:10.0.1.x to outside:4.2.2.1 ID=2618 seq=2 len=56

ICMP echo request translating inside:10.0.1.x to outside:x.x.x.x

ICMP echo request from inside:10.0.1.x to outside:4.2.2.1 ID=2618 seq=3 len=56

ICMP echo request translating inside:10.0.1.x to outside:x.x.x.x

ICMP echo request from inside:10.0.1.x to outside:4.2.2.1 ID=2618 seq=4 len=56

ICMP echo request translating inside:10.0.1.x to outside:x.x.x.x

ICMP echo request from inside:10.0.1.x to outside:4.2.2.1 ID=2618 seq=5 len=56

ICMP echo request translating inside:10.0.1.x to outside:x.x.x.x

2. I added the inspect line anyway, no change.

~Brendan

New Member

Initial Cisco ASA 5510 Config

I was also able to verify (I think...) the proper xlate entries.

gateway# sh xlate | i 10.0.1.x

TCP PAT from any:10.0.1.x/34187 to outside:x.x.x.x/34187 flags ri idle 0:00:06 timeout 0:00:30

TCP PAT from any:10.0.1.x/34186 to outside:x.x.x.x/34186 flags ri idle 0:00:06 timeout 0:00:30

gateway#

~Brendan

New Member

Initial Cisco ASA 5510 Config

I logged a parrellel thread at serverfault and have been making some progress there. Here is the link,

http://serverfault.com/questions/374621/initial-cisco-asa-5510-config.

Basically my outside IP address and gateway are on different subnets and its triggering the ASA to ignore the ARP packets from the gateway with a 'Dropping request at outside from unsolicited non-adjacent 10.42.45.46 2a30.4410.2789 for x.x.x.x 0000.0000.0000'.

~Brendan

Initial Cisco ASA 5510 Config

Brendan,

I noticed from your other thread that you have a Cradlepoint device? Can you remove that device from the mix to see if your problem goes away or have you already done this? I had issues with a Cradlepoint in the past.

John

HTH, John *** Please rate all useful posts ***
New Member

Initial Cisco ASA 5510 Config

Unfortunatly I can't since the Sprint U1901 is a USB device. I'm using the CradlePoint in pass-through mode to translate the connection to RJ-45.

~Brendan

552
Views
0
Helpful
7
Replies
CreatePlease to create content