Cisco ASA Routing

Hi All

We have a ASA 5515-X running 9.1(2) with ASDM 7.1(3)

I am doing a basic set up on it, so external and internal ports config with then a NAT rule and Access rule to just browse out to the web. It has a static route of 0.0.0.0 going to the ISP's gateway. The ASA is sitting in another country, so by having basic internet access I can then use a remote log in tool to finish the config.

I have set a temporary IP for the internal port. But when we try to test the config, we can Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

I am not sure what is causing the block. I have set up ASA 5510's in the same way and they work fine. But running into a road bock with this 5515-X.

I have attached the config for review,
ASA.log
TazzEEAsked:
Who is Participating?
 
Pete LongTechnical ConsultantCommented:
>>Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

Ping from where? the ASA or an internal client? If its the latter is DNS working?

P
0
 
TazzEEAuthor Commented:
Hi Pete

I can ping out from a internal client. I believe DNS is working. The ASA is a replacement for a older Cisco 2811 which works fine.

I have set up the DNS server on the ASA and checked the forwarders on the DC as well and all looks good.

I just can't understand why the browsing isn't working. Even the Network status shows the internet connectivity is good.
0
 
Pete LongTechnical ConsultantCommented:
do this,
object network OBJ_GENERIC_ALL
no nat (internal,external) source dynamic OBJ_GENERIC_ALL interface
nat (internal,external)  dynamic interface

any difference?

PL
0
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

 
TazzEEAuthor Commented:
I am in the UK, and the ASA is in Asia. I am going to make the change now, and get my colleague to test it when he comes into the office.

Will let you know if it makes a difference.

Thanks for your assistance.
0
 
TazzEEAuthor Commented:
Hi Pete

I tried your command of nat (internal,external)  dynamic interface

But it is incomplete. Did you mean

nat (internal,external) source dynamic any interface

Just because the command of

nat(internal,external)  dynamic interface

doesn't have a source address.
0
 
Pete LongTechnical ConsultantCommented:
?
no you don't need the source keyword?

object network OBJ-NAT-ALL
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

Are the commands I use on every firewall I build?
0
 
TazzEEAuthor Commented:
Hi Pete

I managed to solve the issue, after you mentioned the DNS look Up.

So the public DNS look up is pointing to 8.8.8.8 which is google and is on our Domain Controller. When we unplugged our old firewall the DC lost connection to the internet and was unable to do the Public DNS look up as the new ASA was on a different IP address.

Once we change the ASA's internal IP address to match that of the old firewall,  the DC was able to do the DNS look up.

A oversight on my side, but this also helped me to fix another issue I have been facing for a while. All working now.

Thanks for your assistance.
0
 
TazzEEAuthor Commented:
A user comment prompted me to look in a area which I overlooked previously. But doing a system diagram, I was able to pinpoint the issue and fix it.
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.