?
Solved

SBS2008+Cisco ASA 5505, some computers cant use internet

Posted on 2011-10-28
16
Medium Priority
?
474 Views
Last Modified: 2012-05-12
Hi,

Last week I installed a new firewall (Cisco asa 5505 10 users). We only have 7 computers here and like 6 cisco IP phones.

I think the problem begun after I installed the new firewall. Some computers here can't use the internet. Sometimes it works, and sometimes it dont. Everything under ipconfig /all seems just fine. Its exacly the same IP conf for the computers who can use the internet and for those who cannot.

I've opened the ports in the firewall that SBS2008 use (SSL,HTTP,HTTPS, and remote work place port)

I first thought it was the DNS server how gave me trouble, but then I tested to do a NSlookup and it worked just fine.

Right now we only have three computers on, and internet only works for two of them (yesterday all three computers had internet, but like I said, sometimes it works, and sometimes not)

Can anyone please help me? I going crazy here..

0
Comment
Question by:dolsson
16 Comments
 
LVL 4

Expert Comment

by:ubat
ID: 37044514
A Cisco 10 user license means that a maximum of 10 simultaneous connection to the outside "world" is allowed. Phone nr 11 or pc nr 12 will not be allowed to traverse the firewall. This may be the cause of your problems or part of the cause.
0
 

Author Comment

by:dolsson
ID: 37044629
Ok, thanks. But right now, we have only 8 connections to the outside. Its only 5 telephones, and 3 computers.

On the asa, its recommend that we connect the phones directly to the routers (ppoe), but does that matter?

Thanks
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37044844
Its only 5 telephones, and 3 computers. But in the question you stated We only have 7 computers here and like 6 cisco IP phones.
So are you sure?
If you do a 'show hosts' on the asa, what do you see?
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 

Author Comment

by:dolsson
ID: 37044967
I'm really new to cisco . The only thing I've succeded doing so far is to open a few ports, and change the IP adress of the router, and all that from the ASDM.

Well, I cant type show hosts on the CLI - invalid input.

Is there another way I can see all the devices that are connected?

Thanks

0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37045019
Sorry, my wrong.
Try: show local-host
0
 

Author Comment

by:dolsson
ID: 37045058
Result of the command: "show local-host"

Detected interface 'outside' as the Internet interface. Host limit applies to all other interfaces.
Current host count: 10, towards licensed host limit of: 10

Interface outside: 221 active, 479 maximum active, 0 denied
local host: <173.194.32.40>,
 
This was on the top of all the other logs. I guess that means that we have 10 connected devices?
Can I see all the IP adresses of devices that are active on the network?

Thanks
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37045079
Let's see, try: show local-host brief
0
 

Author Comment

by:dolsson
ID: 37045101
It only shows this Result of the command: "show local-host brief"

Detected interface 'outside' as the Internet interface. Host limit applies to all other interfaces.
Current host count: 10, towards licensed host limit of: 10

Interface outside: 192 active, 479 maximum active, 0 denied
local host: <212.118.226.93>,

And like 100 of these lines but different content off course

    TCP flow count/limit = 0/unlimited
    TCP embryonic count to host = 0
    TCP intercept watermark = unlimited
    UDP flow count/limit = 0/unlimited
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37045155
Oh wait, misread that. You just want to see whats active on the network now......
Might want to try some network scanner for that: http://www.softperfect.com/products/networkscanner/
0
 

Author Comment

by:dolsson
ID: 37045191
Actually, I just want to see if we are using 10 devices on the network, so we can find out if that is the reason to my problem (licensing problem).

But how does the license work? Is it ten devices that i active simultaneously, or how does the ASA count it?
0
 

Author Comment

by:dolsson
ID: 37045213
The netscan show me 15 MAC adresses, but how do I know that those are connected to the internet and are using the ASA?

Isn't it a easier way on the ASA that can show me how many devices that are connected to it?
0
 
LVL 35

Accepted Solution

by:
Ernie Beek earned 400 total points
ID: 37045308
There is a way, do a: sh xlate interface inside
Then count the number of unique internal ip's.
I'm afraid there isn't a simple command to just show the connected hosts but this works as well.
0
 

Author Comment

by:dolsson
ID: 37045341
I counted it to ten, so maybe this is the problem?

On monday I will try turn off a device, and see if that helps.

Thanks, and have a nice weekend. I update on monday
0
 
LVL 35

Expert Comment

by:Ernie Beek
ID: 37045385
Remember, this shows the same as with the show local command, you reached the limit of 10.
Every machine on the network that has the asa as It's default gateway can use one of the connections. So if you counted 15.........
0
 
LVL 79

Assisted Solution

by:lrmoore
lrmoore earned 100 total points
ID: 37048742
Your best bet is to upgrade the 10 user license to 50 user. Then you just won't have to worry about it.
Your post is pretty clear that it is a license issue..

Current host count: 10, towards licensed host limit of: 10
0
 
LVL 12

Expert Comment

by:jjmartineziii
ID: 37050122
I agree with lmoore. The license cost isn't that much. I would bump that upbringing 50 and your problems shall disappear
0

Featured Post

Free Tool: Subnet Calculator

The subnet calculator helps you design networks by taking an IP address and network mask and returning information such as network, broadcast address, and host range.

One of a set of tools we're offering as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

I found an issue or “bug” in the SonicOS platform (the firmware controlling SonicWALL security appliances) that has to do with renaming Default Service Objects, which then causes a portion of the system to become uncontrollable and unstable. BACK…
Getting hacked is no longer a matter or "if you get hacked" — the 2016 cyber threat landscape is now titled "when you get hacked." When it happens — will you be proactive, or reactive?
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

621 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question