Solved

Can someone help me figure out why this base config for an ASA 5505 won't work?

Posted on 2011-09-29
17
356 Views
Last Modified: 2012-06-21
Hello,

We will preface this by stating that I am a total Cisco noob.  I know that there are reams of documentation out there, but unfortunately I don't have the time at this point to go through it all, so I am hoping someone can give me some assistance.

I need to install a new ASA 5505 in an office that currently has NO firewall protection.  It has a cable modem with a static IP address assignment (we actually have a block of 8).

I went through the initial startup and configuration wizard with the ASA, and couldn't get it to pass traffic through to the internet... well, that may NOT be true (I am a noob in the worst way), but at any rate I cannot get a pc attached to the inside vlan to resolve a web page.

To try to troubleshoot, I took the patch cable connecting the cable modem to the ASA's port 0 (outside vlan) and attached it directly to my pc.  I then configured the nic on the pc with the static assigned IP, subnet, and gateway information provided by my cable ISP... the pc worked perfectly, and I was able to resolve web pages.

However, no matter what I try, I can't seem to make the ASA ping out, much less allow a machine on it's inside network to access the internet.

I have attached the configuration... can someone please take a look and tell me if you can spot the error?

Thanks,

Scott show-20running-config-20asdm-san.txt
0
Comment
Question by:meelnah
  • 8
  • 4
  • 4
  • +1
17 Comments
 
LVL 3

Assisted Solution

by:LinuxNinja
LinuxNinja earned 167 total points
ID: 36880480
Before I even look at the ASA config, keep in mind that moving the CAT5 from PC to router requires you to reboot the cablemodem. It memorizes the MAC of your PC and locks it in. When you move the CAT5 to the router, a reboot is required so that the cablemodem will pick up the MAC of the router. This is true of every ISP I have dealt with, but YMMV.
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36882254
Besides the line:

dhcpd auto_config outside

which should be removed, I don't see an obvious problem. If removing that line and rebooting the cablemodem doesn't get you online, can you be sure you're XXXXX config parameters are correct?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36883486
YMMV?  Sorry... it's really late here!

I just rebooted the cable modem, and after it came back up, rebooted the ASA.  No change to my problem though.

I will keep your advice on the cable modem in mind though... thanks!
0
 
LVL 1

Author Comment

by:meelnah
ID: 36887079
removed the dhcpd auto_config outside line with no change...

As for the IP address settings, I checked them again and they seem in order.  I know that they worked when inputted directly into the pc earlier this evening.  I will re-verify them with the ISP tomorrow to be sure.

A silly question, but there isn't some sort of registration process that needs to be done on the ASA before you configure it, is there?  I am just using the base license, no anyconnect or security plus licenses or anything like that...
0
 
LVL 34

Assisted Solution

by:Istvan Kalmar
Istvan Kalmar earned 167 total points
ID: 36889963
Hi,

In the first look te config seems to be good, you need to set DNS for dhcp:
dhcpd dns 8.8.8.8 8.8.8.4 interface inside
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36889986
That should be 8.8.8.8 and 8.8.4.4 for Google's DNS servers. Common typo.

See:

Google Public DNS
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36889989
YMMV = Your Mileage May Vary
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 166 total points
ID: 36890524
Let's see,

When the firewall is in place, can you ping it (192.168.1.250)?
Can you ping out to an ip address, for example 8.8.8.8 (so not using DNS)?
From the ASA, can you ping out to the internet (8.8.8.8 again)?
Can you connect to the ASDM and check the logs to see if anything shows up there?
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 1

Author Comment

by:meelnah
ID: 36891358
ikalmar,

thanks for weighing in... I disabled DHCP on the inside interface (didn't post the updated running config, but just removed the dhcp auto_config outside line), and set manual DNS entries in the defaultDNS server-group.

enrniebeek,

From a pc attached to VLAN 1, I can ping the inside interface (192.168.1.250).  However, I cannot ping the outside interface... but I don't know if I should be able to ping my external interface from inside the ASA.

I cannot ping the dns servers at this point.

Scott
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891438
That's correct, you can only ping the interface facing you.

So did you try to do a ping from the ASA to the internet?
Also try to connect to the ASDM to have a look at the logs when you try to connect to the internet.
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891486
yes, I tried pinging the dns servers on the interent, with no success.  Also tried pinging a website, but the ASA is unable to resolve the host name (which also points to it not being able to pass traffic).

I am unfamiliar with the ASA product.. I will certainly check the logs.  Can you give me some direction there?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891570
I found where to enable logging, and turned it on.  I then did a ping test to 4.2.2.2 and saved the log file (logging level was set to debug... is this correct?).

I then cleared the logs and tried to open internet explorer and go to google.com.  I attached the resulting logs from that as well.

I don't see anything 'negative' in the logs though... or am I reading them wrong? 7883PingLogDebugLevel
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891584
and here are the results from trying to access google...

forgot to mention, both tests were run from a pc attached to the inside interface of the ASA. 7883WebRequestLogDebugLevel
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891618
Hm, nothing strage there in the first log. In the second I can only see your connection to the firewall, nothing going to google.
Let's try it step by step. From the ASA, can you ping the cable modem?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891650
the modem itself doesn't have an address, but we have a gateway assignment for our block of IP addresses.  Ping requests to this gateway fail.

As for the second log, I am guessing we are only seeing connections to the firewall because I tried to navigate to google.com... the ASA is curently set as my DNS server, so it should have tried to resolve google.com... would that be in the log?
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891995
Ok......................

Afaik the ASA cannot be used as a DNS server. So if you get your connectivity right, you'll need to set your client to a different dns server.
0
 
LVL 1

Author Comment

by:meelnah
ID: 36892297
thanks for the info... what is the DNS server group that is defined in the config then?  who is it resolving addresses for?

thansk!
0

Featured Post

What Security Threats Are You Missing?

Enhance your security with threat intelligence from the web. Get trending threat insights on hackers, exploits, and suspicious IP addresses delivered to your inbox with our free Cyber Daily.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5506 4 39
Cisco switch SVI 17 42
Cisco WLC: Blocking specific MAC address 3 43
Cisco vlan question 12 43
How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Excel styles will make formatting consistent and let you apply and change formatting faster. In this tutorial, you'll learn how to use Excel's built-in styles, how to modify styles, and how to create your own. You'll also learn how to use your custo…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

744 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

8 Experts available now in Live!

Get 1:1 Help Now