Link to home
Start Free TrialLog in
Avatar of ok-fonden
ok-fonden

asked on

Cisco ASA

Hi.

I got an Cisco ASA 5505 and have configured it as simple as possible
just for use in a test-network.

I got the IP-address from my provider
The DNS is the one we normaly use (it works in my other router)
The PC I connect to the ASA get's the 10.100.2.x IP-address, the gateway
and the DNS, but no connection to the internet.

Setup is attached.....

Thanks
ASA.txt
Avatar of anoopkmr
anoopkmr
Flag of United States of America image

show ip --> and check u got the IP address from ISP?

show route --> and see  u get the correct gateway ?

try to ping that gateway ip from the ASA ?

try to ping the ISP DNS server IP from ASA ?

how u r testing the internet connection from the PC ?

from the PC try nslookup and see name resolution is happening / or  use the  IP address to browse.
How are you testing? By pinging something?  If so, ICMP (ping) isn't allowed by default.

policy-map global_policy
 class inspection_default
  inspect icmp
Avatar of ok-fonden
ok-fonden

ASKER

Got the IP and the gateway
Can't ping the DNS from ASA.
Try access website by IP
Will try the NSlookup

Thanks
can u able to ping the gw of ASA  from ASA ?

give me the output of below commands from ASA

show route
show ip

I'l do that.
Has to switch ASA so my connection will be lost :-)
Return in a while
stema# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 81.161.188.1 to network 0.0.0.0

C    81.161.188.0 255.255.252.0 is directly connected, outside
C    127.1.0.0 255.255.0.0 is directly connected, _internal_loopback
C    10.100.20.0 255.255.255.0 is directly connected, inside
d*   0.0.0.0 0.0.0.0 [1/0] via 81.161.188.1, outside
stema# sh ip
System IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
Vlan1                    inside                 10.100.20.1     255.255.255.0   CONFIG
Vlan2                    outside                81.161.188.174  255.255.252.0   DHCP  
Current IP Addresses:
Interface                Name                   IP address      Subnet mask     Method
Vlan1                    inside                 10.100.20.1     255.255.255.0   CONFIG
Vlan2                    outside                81.161.188.174  255.255.252.0   DHCP  
show me the  nslookup from ur PC ( www.google.com)

Your original config had 10.100.2.1 for the inside interface yet your "show ip" has 10.100.20.1.  If you changed addresses for the inside, did you update the DHCP config also?

no dhcpd address 10.100.2.100-10.100.2.120 inside
dhcpd address 10.100.20.100-10.100.20.120 inside

Make sure to do a ipconfig /release and ipconfig /renew afterwards.
Sorry, yes I updated dhcpd and renewed IP
C:\Documents and Settings\okfsma>nslookup www.google.dk
*** Can't find server name for address 194.239.134.83: Query refused
*** Can't find server name for address 193.162.153.164: Query refused
*** Default servers are not available
Server:  UnKnown
Address:  194.239.134.83

*** UnKnown can't find www.google.dk: Query refused
On the asa that is OK, the gateway and IP gives the same result
withe the SH ROUTE and SH IP command
Try different DNS servers.  Try 4.4.4.2.
Have tried other DNS servers with no result.
Returned to this ones, because we are using them in the intire org.
try to browse with IP ; for eg:

http://173.194.37.104/

ur  DNS servers are not responding to query.
Try that in a minut, but spooky, because our DNS-server in the org
has those forwarders in the DNS-server, and it works - wierd
By the way, you can always try plugging this connection into a PC/Laptop and see if you can browse to verify the connection is fine.
Think I look me blind, cause I allways try that
but nor this time cause this DNS works everywhere.
It worked by using direct IP.
Any suggest why DNS dosn't work ?

Thank a lot - feels a little stupid :-)
Have you tried using the DNS servers your ISP gave you?

You can turn off the DNS inspection just in case the ASA doesn't like something.

conf t
policy-map global_policy
 class inspection_default
  no inspect dns preset_dns_map
Have tried 8 different DNS servers now, and with same result.
The NO inspect I just tried without succes
just check with ur ISP ?
Did the 8 different DNS servers contain the ones provided to you by your ISP?
Oki - thanks. These are closed now so I try in the morning
ASKER CERTIFIED SOLUTION
Avatar of ok-fonden
ok-fonden

Link to home
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
Start Free Trial