Cisco ASA 5505 Version 8.3(1)

Enable icmp inspect so you can try to ping the dns servers from an inside host

policy-map global_policy
class inspection_default
inspect icmp

ASKER

Hi lrmoore

thanks for responding to my question

i added the the global commands and see no change. from the server located at 192.168.1.3 i am able to browse the internet however all of the other clients that are behind this ASA are unable to get out. (sorry if this sounds like i am repeating myself)

ASKER

i did a show version for your viewing pleasures :)

is this correct? a 10 limit on hosts?

HATCH-ASA# show ver

Cisco Adaptive Security Appliance Software Version 8.3(1)
Device Manager Version 6.3(1)

Compiled on Thu 04-Mar-10 16:56 by builders
System image file is "disk0:/asa831-k8.bin"
Config file at boot was "startup-config"

HATCH-ASA up 2 days 12 hours

Hardware:   ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW016 @ 0xfff00000, 2048KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
                             Boot microcode   : CN1000-MC-BOOT-2.00
                             SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
                             IPSec microcode  : CNlite-MC-IPSECm-MAIN-2.06
 0: Int: Internal-Data0/0    : address is e05f.b948.3609, irq 11
 1: Ext: Ethernet0/0         : address is e05f.b948.3601, irq 255
 2: Ext: Ethernet0/1         : address is e05f.b948.3602, irq 255
 3: Ext: Ethernet0/2         : address is e05f.b948.3603, irq 255
 4: Ext: Ethernet0/3         : address is e05f.b948.3604, irq 255
 5: Ext: Ethernet0/4         : address is e05f.b948.3605, irq 255
 6: Ext: Ethernet0/5         : address is e05f.b948.3606, irq 255
 7: Ext: Ethernet0/6         : address is e05f.b948.3607, irq 255
 8: Ext: Ethernet0/7         : address is e05f.b948.3608, irq 255
 9: Int: Internal-Data0/1    : address is 0000.0003.0002, irq 255
10: Int: Not used            : irq 255
11: Int: Not used            : irq 255

Licensed features for this platform:
Maximum Physical Interfaces    : 8              perpetual
VLANs                          : 3              DMZ Restricted
Dual ISPs                      : Disabled       perpetual
VLAN Trunk Ports               : 0              perpetual
Inside Hosts                   : 10             perpetual
Failover                       : Disabled       perpetual
VPN-DES                        : Enabled        perpetual
VPN-3DES-AES                   : Enabled        perpetual
SSL VPN Peers                  : 2              perpetual
Total VPN Peers                : 10             perpetual
Shared License                 : Disabled       perpetual
AnyConnect for Mobile          : Disabled       perpetual
AnyConnect for Cisco VPN Phone : Disabled       perpetual
AnyConnect Essentials          : Disabled       perpetual
Advanced Endpoint Assessment   : Disabled       perpetual
UC Phone Proxy Sessions        : 2              perpetual
Total UC Proxy Sessions        : 2              perpetual
Botnet Traffic Filter          : Disabled       perpetual
Intercompany Media Engine      : Disabled       perpetual

This platform has a Base license.

Serial Number: JMX1452Z018
Running Permanent Activation Key: 0x3103cc7a 0x205b8342 0x5443a580 0x9ae8c4b8 0x
c4172d83
Configuration register is 0x1
Configuration last modified by enable_15 at 09:05:44.275 PST Mon Feb 14 2011
HATCH-ASA#

Open in new window

ASKER CERTIFIED SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Pugglewuggle

One other thing that you must keep in mind is that the ASA tracks inside MAC addresses and once that number exceeds 10 you will begin to see dropped traffic and messages in the event log that say the maximum number of user licenses has been exceeded. This is because your license only allows for 10 inside hosts as is shown in the sh ver output.

If the license is being exceeded you will need to purchase a license upgrade. The unlimited inside hosts license isn't too bad, it's like $300 USD.

You should be aware of this as well as it can lead to dropped traffic and other initially inexplicable errors, especially if you have virtualized servers or workstations using VMware or an equivalent.

Cheers!

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

thanks guys, ill give this a shot!

also i have never run into an ASA with restricted DHCP licensing on the inside

Hasnt it always been on the number of SSL, Site 2 Site VPNS, and client VPNS?

John

Pugglewuggle

that is the case on all ASA platforms, except on the 5505 you also have an inside user license to watch out for. All ASAs other than the 5505 are unlimited inside, and of course you can buy the unlimited 5505 license.

Cheers!

SOLUTION

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

ASKER

lrmoore, puggle

thank you for your responses - much appreciated.

if i get a 5510, will i still run into the same DHCP issue or is the device unlimited ?

thanks again

SOLUTION

Pugglewuggle

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.