Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Cisco ASA 5505 - Basic Web Access

Hello all,

Not posted here in a while but thought you guys might be able to help me out with a little problem. Okay, I have a Cisco ASA5505 running the latest asdm and ios...

[I]Cisco Adaptive Security Appliance Software Version 8.4(2)

Device Manager Version 6.4(5)206[/I]

I am trying to get basic web resolution and access but not having any luck. I just wanted to know if there is anything special that I needed to do with the ASA before I can do this. I've made a quick visio diagram of the network, see below:

[URL=http://imageshack.us/photo/my-images/4/diag.png/][IMG]http://img4.imageshack.us/img4/94/diag.th.png[/IMG][/URL]

The Vigor has a local subnet of 192.168.0.x/24 however there is also a "For routing use only" option. See below:

[URL=http://imageshack.us/photo/my-images/717/diag2.png/][IMG]http://img717.imageshack.us/img717/9131/diag2.th.png[/IMG][/URL]

I'm hopeful that by configuring the "For routing use ip address" as one of my allocation of public ip's, that it should work okay. I can actually ping by IP and name from the interface of the ASA but can't do that or browse to websites from clients which have their default gateway set to 192.168.0.252.

I was under the assumption web browsing should work out of the box almost as it's treated as an outgoing connection. Here is my config for you to look at:

(note, I've tried to set the route outside to the local ip of the draytek and also the "For routing usage only" IP address)

ASA Version 8.4(2)

!

hostname gilwoodasa

domain-name gilwood.local

enable password 9PvFytIZ2Vpy8Gon encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.0.252 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 82.70.231.xx 255.255.255.248

!

interface Vlan5

no nameif

security-level 50

ip address dhcp

!

boot system disk0:/asa842-k8.bin

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 192.168.0.3

domain-name xxxxxxxxx

object-group network obj_any

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-645-206.bin

no asdm history enable

arp timeout 14400

!

nat (inside,outside) after-auto source dynamic any interface

route outside 0.0.0.0 0.0.0.0 82.70.231.49 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

telnet timeout 5

ssh 192.168.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl encryption 3des-sha1 des-sha1 rc4-md5 aes128-sha1 aes256-sha1

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http [url]https://tools.cisco.com/its/service/oddce/services/DDCEService[/url]

  destination address email [email]callhome@cisco.com[/email]

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:4c06870d7d65d349cb63bd8044d61b35

: end

So, if you're still reading this - all I am after is a way to get basic web browsing working. Here are the logs which show the attempted web access...

[URL=http://imageshack.us/photo/my-images/338/logsi.png/][IMG]http://img338.imageshack.us/img338/671/logsi.th.png[/IMG][/URL]

Big thank you in advance!

7 REPLIES

Cisco ASA 5505 - Basic Web Access

Hi,

Try with below changes..

object-group network obj_any

     subnet 0.0.0.0 0.0.0.0 

      nat (inside,outside) dynamic interface
!


Thx

MS

New Member

Cisco ASA 5505 - Basic Web Access

Hi,

Thanks for the suggestion... tried that but get the following error:

http://imageshack.us/photo/my-images/194/asaei.png/

Any further help most appreciated!

Cisco ASA 5505 - Basic Web Access

My mistake.. The cmmand syntax supposed to be...

object network obj_any

     subnet 0.0.0.0 0.0.0.0 

      nat (inside,outside) dynamic interface

Try this and post the result.

Thx

MS

New Member

Cisco ASA 5505 - Basic Web Access

Hey, thanks for the reply. I have tried the suggestion but to no avail. I can ping google from the outside interface but can't ping it from anything on the inside. This does tend to point towards a NAT issue. Hopefully someone has another suggestion?

Here are the results from the ASA console when trying to ping from both the inside and outside interface. The successful ones re from the outside.

http://imageshack.us/photo/my-images/209/pingbf.png/

Thanks again! Complete config now is as follows:

ASA Version 8.4(2)

!

hostname xxxxx

domain-name xxxx

enable password 9PvFytIZ2Vpy8Gon encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.0.252 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 82.70.231.xx 255.255.255.248

!

interface Vlan5

no nameif

security-level 50

ip address dhcp

!

boot system disk0:/asa842-k8.bin

ftp mode passive

dns domain-lookup inside

dns domain-lookup outside

dns server-group DefaultDNS

name-server 208.67.222.222

name-server 192.168.0.3

domain-name gilwood.local

object network obj_any

subnet 0.0.0.0 0.0.0.0

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

icmp permit any inside

icmp permit any outside

asdm image disk0:/asdm-645-206.bin

no asdm history enable

arp timeout 14400

!

object network obj_any

nat (inside,outside) dynamic interface

!

nat (inside,outside) after-auto source dynamic any interface

route outside 0.0.0.0 0.0.0.0 82.70.231.49 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

http 192.168.0.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

telnet timeout 5

ssh 192.168.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

ssl encryption 3des-sha1 des-sha1 rc4-md5 aes128-sha1 aes256-sha1

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

  inspect ip-options

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DD                                                                                                  CEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:5caa6e14d9c76e0858b055316071710f

: end

Cisco ASA 5505 - Basic Web Access

Can you try by removing this..?

nat (inside,outside) after-auto source dynamic any interface

Also, make sure the DNS from inside is working. if not, try using IP.

Thx

MS

New Member

Cisco ASA 5505 - Basic Web Access

Hi, tried removing that line... same result. DNS is working but it won't route the packet outside. It seems to think that the packet is destined for the inside network. I've captured some logs, see screen shot. This is quite frustrating.

Thank you for your patience with this problem!

http://imageshack.us/photo/my-images/21/logging.png/

Cisco ASA 5505 - Basic Web Access

object network obj_any

     subnet 0.0.0.0 0.0.0.0 

      nat (inside,outside) dynamic interface

supposed to work. You do not need after-auto statement. If I remember correct, it reference to twice NAT.

Try enabling 'debug icmp trace' on ASA and try to ping from PC and check what ASA console messages.

Thx

MS

2657
Views
0
Helpful
7
Replies
CreatePlease login to create content