Solved

Can someone help me figure out why this base config for an ASA 5505 won't work?

Posted on 2011-09-29
17
358 Views
Last Modified: 2012-06-21
Hello,

We will preface this by stating that I am a total Cisco noob.  I know that there are reams of documentation out there, but unfortunately I don't have the time at this point to go through it all, so I am hoping someone can give me some assistance.

I need to install a new ASA 5505 in an office that currently has NO firewall protection.  It has a cable modem with a static IP address assignment (we actually have a block of 8).

I went through the initial startup and configuration wizard with the ASA, and couldn't get it to pass traffic through to the internet... well, that may NOT be true (I am a noob in the worst way), but at any rate I cannot get a pc attached to the inside vlan to resolve a web page.

To try to troubleshoot, I took the patch cable connecting the cable modem to the ASA's port 0 (outside vlan) and attached it directly to my pc.  I then configured the nic on the pc with the static assigned IP, subnet, and gateway information provided by my cable ISP... the pc worked perfectly, and I was able to resolve web pages.

However, no matter what I try, I can't seem to make the ASA ping out, much less allow a machine on it's inside network to access the internet.

I have attached the configuration... can someone please take a look and tell me if you can spot the error?

Thanks,

Scott show-20running-config-20asdm-san.txt
0
Comment
Question by:meelnah
  • 8
  • 4
  • 4
  • +1
17 Comments
 
LVL 3

Assisted Solution

by:LinuxNinja
LinuxNinja earned 167 total points
ID: 36880480
Before I even look at the ASA config, keep in mind that moving the CAT5 from PC to router requires you to reboot the cablemodem. It memorizes the MAC of your PC and locks it in. When you move the CAT5 to the router, a reboot is required so that the cablemodem will pick up the MAC of the router. This is true of every ISP I have dealt with, but YMMV.
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36882254
Besides the line:

dhcpd auto_config outside

which should be removed, I don't see an obvious problem. If removing that line and rebooting the cablemodem doesn't get you online, can you be sure you're XXXXX config parameters are correct?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36883486
YMMV?  Sorry... it's really late here!

I just rebooted the cable modem, and after it came back up, rebooted the ASA.  No change to my problem though.

I will keep your advice on the cable modem in mind though... thanks!
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 
LVL 1

Author Comment

by:meelnah
ID: 36887079
removed the dhcpd auto_config outside line with no change...

As for the IP address settings, I checked them again and they seem in order.  I know that they worked when inputted directly into the pc earlier this evening.  I will re-verify them with the ISP tomorrow to be sure.

A silly question, but there isn't some sort of registration process that needs to be done on the ASA before you configure it, is there?  I am just using the base license, no anyconnect or security plus licenses or anything like that...
0
 
LVL 34

Assisted Solution

by:Istvan Kalmar
Istvan Kalmar earned 167 total points
ID: 36889963
Hi,

In the first look te config seems to be good, you need to set DNS for dhcp:
dhcpd dns 8.8.8.8 8.8.8.4 interface inside
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36889986
That should be 8.8.8.8 and 8.8.4.4 for Google's DNS servers. Common typo.

See:

Google Public DNS
0
 
LVL 3

Expert Comment

by:LinuxNinja
ID: 36889989
YMMV = Your Mileage May Vary
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 166 total points
ID: 36890524
Let's see,

When the firewall is in place, can you ping it (192.168.1.250)?
Can you ping out to an ip address, for example 8.8.8.8 (so not using DNS)?
From the ASA, can you ping out to the internet (8.8.8.8 again)?
Can you connect to the ASDM and check the logs to see if anything shows up there?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891358
ikalmar,

thanks for weighing in... I disabled DHCP on the inside interface (didn't post the updated running config, but just removed the dhcp auto_config outside line), and set manual DNS entries in the defaultDNS server-group.

enrniebeek,

From a pc attached to VLAN 1, I can ping the inside interface (192.168.1.250).  However, I cannot ping the outside interface... but I don't know if I should be able to ping my external interface from inside the ASA.

I cannot ping the dns servers at this point.

Scott
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891438
That's correct, you can only ping the interface facing you.

So did you try to do a ping from the ASA to the internet?
Also try to connect to the ASDM to have a look at the logs when you try to connect to the internet.
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891486
yes, I tried pinging the dns servers on the interent, with no success.  Also tried pinging a website, but the ASA is unable to resolve the host name (which also points to it not being able to pass traffic).

I am unfamiliar with the ASA product.. I will certainly check the logs.  Can you give me some direction there?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891570
I found where to enable logging, and turned it on.  I then did a ping test to 4.2.2.2 and saved the log file (logging level was set to debug... is this correct?).

I then cleared the logs and tried to open internet explorer and go to google.com.  I attached the resulting logs from that as well.

I don't see anything 'negative' in the logs though... or am I reading them wrong? 7883PingLogDebugLevel
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891584
and here are the results from trying to access google...

forgot to mention, both tests were run from a pc attached to the inside interface of the ASA. 7883WebRequestLogDebugLevel
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891618
Hm, nothing strage there in the first log. In the second I can only see your connection to the firewall, nothing going to google.
Let's try it step by step. From the ASA, can you ping the cable modem?
0
 
LVL 1

Author Comment

by:meelnah
ID: 36891650
the modem itself doesn't have an address, but we have a gateway assignment for our block of IP addresses.  Ping requests to this gateway fail.

As for the second log, I am guessing we are only seeing connections to the firewall because I tried to navigate to google.com... the ASA is curently set as my DNS server, so it should have tried to resolve google.com... would that be in the log?
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 36891995
Ok......................

Afaik the ASA cannot be used as a DNS server. So if you get your connectivity right, you'll need to set your client to a different dns server.
0
 
LVL 1

Author Comment

by:meelnah
ID: 36892297
thanks for the info... what is the DNS server group that is defined in the config then?  who is it resolving addresses for?

thansk!
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
This past year has been one of great growth and performance for OnPage. We have added many features and integrations to the product, making 2016 an awesome year. We see these steps forward as the basis for future growth.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

831 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question