Some clients cannot reach Internet after introduction of ASA 5505

Posted on 2011-04-19
Last Modified: 2012-06-27
I have a small office network of 10 laptops.  They get their IP info from a Windows server that provides DHCP services including the gateway and DNS options.  I introduced an ASA 5505 yesterday and everything ran fine for hours.  At some point a few of the clients lost Internet connectivity.  They could still see all resources on the LAN side of the firewall.  The IP settings are correct in ipconfig.  I cleared the arp caches which did not help.  I changed the stations to static IP addresses and that seemed to work for awhile but then they failed again.  I switched them all back to DHCP clients.

Today all the laptops were able to maintain Internet connectivity until about an hour ago when 2 of them lost Internet access.  They retain access to all devices on the LAN.  The rest of the stations are still working fine.  The IP settings on these 2 stations are all correct.

I cannot ping from these 2 stations although the name does get resolved.  I cannot tracert anywhere off the network "Request timed out".  I can tracert anywhere on the LAN.  I can ping the gateway.  There is only one DHCP server on the network.  

The ASA configuration is very basic.  I removed most of it with a clear config and only built the two VLAN interfaces, a static for the webserver which includes an access-group and service-group, and the outside NAT 1, etc..  It seems like it is running out of addresses or licenses.   When it reaches a certain limit of time, clients, heat, I don't know, it stops allowing connections.  Sometimes it drops the currently connected ones and other times it doesn't.

Any help would be appreciated.

Question by:terry_cole
    LVL 17

    Accepted Solution

    Can it be a license limitation? Please post output from "show version" and "show local-host" here.

    LVL 24

    Assisted Solution

    by:Ken Boone CCIE #4649
    So the ASA has different licensing options - One of which is a 10 user license.  Basically the ASA counts the number of internal IPs as it goes through the firewall.  Once you hit 10 you are done.  So if you have 10 laptops, 1 server and a printer or 2, that could cause what you see.  Issue a show version command to show the license info.

    Also, when you are hitting the limit you will get a log message.  Enter a show log command to see the log when this occurs.  The log gets overwritten very quickly so you may or may not see this.

    It sounds like thisis your problem to me.  You can upgrade your license though.

    Author Closing Comment

    Thanks, I believe it is a licensing issue.  I wasn't aware of the IP limit.  Testing by having one user log off permits another to log on.  I believe an upgraded license is called for....

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    What Security Threats Are You Missing?

    Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

    Suggested Solutions

    Title # Comments Views Activity
    increase internet speed 3 38
    cisco 800 newbe 4 41
    Sonicwall Scheduling 4 16
    Cisco ASA 5506 - port forwarding not working 10 30
    Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
    In the world of WAN, QoS is a pretty important topic for most, if not all, networks. Some WAN technologies have QoS mechanisms built in, but others, such as some L2 WAN's, don't have QoS control in the provider cloud.
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
    After creating this article (, I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

    760 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now