Solved

Cisco ASA Routing

Posted on 2014-12-18
8
128 Views
Last Modified: 2014-12-27
Hi All

We have a ASA 5515-X running 9.1(2) with ASDM 7.1(3)

I am doing a basic set up on it, so external and internal ports config with then a NAT rule and Access rule to just browse out to the web. It has a static route of 0.0.0.0 going to the ISP's gateway. The ASA is sitting in another country, so by having basic internet access I can then use a remote log in tool to finish the config.

I have set a temporary IP for the internal port. But when we try to test the config, we can Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

I am not sure what is causing the block. I have set up ASA 5510's in the same way and they work fine. But running into a road bock with this 5515-X.

I have attached the config for review,
ASA.log
0
Comment
Question by:TazzEE
  • 5
  • 3
8 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 500 total points
ID: 40507042
>>Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

Ping from where? the ASA or an internal client? If its the latter is DNS working?

P
0
 

Author Comment

by:TazzEE
ID: 40507097
Hi Pete

I can ping out from a internal client. I believe DNS is working. The ASA is a replacement for a older Cisco 2811 which works fine.

I have set up the DNS server on the ASA and checked the forwarders on the DC as well and all looks good.

I just can't understand why the browsing isn't working. Even the Network status shows the internet connectivity is good.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507113
do this,
object network OBJ_GENERIC_ALL
no nat (internal,external) source dynamic OBJ_GENERIC_ALL interface
nat (internal,external)  dynamic interface

any difference?

PL
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 

Author Comment

by:TazzEE
ID: 40507168
I am in the UK, and the ASA is in Asia. I am going to make the change now, and get my colleague to test it when he comes into the office.

Will let you know if it makes a difference.

Thanks for your assistance.
0
 

Author Comment

by:TazzEE
ID: 40507318
Hi Pete

I tried your command of nat (internal,external)  dynamic interface

But it is incomplete. Did you mean

nat (internal,external) source dynamic any interface

Just because the command of

nat(internal,external)  dynamic interface

doesn't have a source address.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507810
?
no you don't need the source keyword?

object network OBJ-NAT-ALL
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

Are the commands I use on every firewall I build?
0
 

Assisted Solution

by:TazzEE
TazzEE earned 0 total points
ID: 40512775
Hi Pete

I managed to solve the issue, after you mentioned the DNS look Up.

So the public DNS look up is pointing to 8.8.8.8 which is google and is on our Domain Controller. When we unplugged our old firewall the DC lost connection to the internet and was unable to do the Public DNS look up as the new ASA was on a different IP address.

Once we change the ASA's internal IP address to match that of the old firewall,  the DC was able to do the DNS look up.

A oversight on my side, but this also helped me to fix another issue I have been facing for a while. All working now.

Thanks for your assistance.
0
 

Author Closing Comment

by:TazzEE
ID: 40519494
A user comment prompted me to look in a area which I overlooked previously. But doing a system diagram, I was able to pinpoint the issue and fix it.
0

Featured Post

Independent Software Vendors: We Want Your Opinion

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Alot of sessions on a PC is generated 3 81
Eset Smart Securties ARP poisoning attack 3 45
SSL-VPN 1 47
Citrix App 7 28
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
In this article, I am going to show you how to simulate a multi-site Lab environment on a single Hyper-V host. I use this method successfully in my own lab to simulate three fully routed global AD Sites on a Windows 10 Hyper-V host.
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

756 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question