Cisco ASA Routing

Hi All

We have a ASA 5515-X running 9.1(2) with ASDM 7.1(3)

I am doing a basic set up on it, so external and internal ports config with then a NAT rule and Access rule to just browse out to the web. It has a static route of 0.0.0.0 going to the ISP's gateway. The ASA is sitting in another country, so by having basic internet access I can then use a remote log in tool to finish the config.

I have set a temporary IP for the internal port. But when we try to test the config, we can Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

I am not sure what is causing the block. I have set up ASA 5510's in the same way and they work fine. But running into a road bock with this 5515-X.

I have attached the config for review,
ASA.log
Kevin TurnbullIT ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Pete LongTechnical ConsultantCommented:
>>Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

Ping from where? the ASA or an internal client? If its the latter is DNS working?

P
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Kevin TurnbullIT ManagerAuthor Commented:
Hi Pete

I can ping out from a internal client. I believe DNS is working. The ASA is a replacement for a older Cisco 2811 which works fine.

I have set up the DNS server on the ASA and checked the forwarders on the DC as well and all looks good.

I just can't understand why the browsing isn't working. Even the Network status shows the internet connectivity is good.
0
Pete LongTechnical ConsultantCommented:
do this,
object network OBJ_GENERIC_ALL
no nat (internal,external) source dynamic OBJ_GENERIC_ALL interface
nat (internal,external)  dynamic interface

any difference?

PL
0
Determine the Perfect Price for Your IT Services

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden with our free interactive tool and use it to determine the right price for your IT services. Download your free eBook now!

Kevin TurnbullIT ManagerAuthor Commented:
I am in the UK, and the ASA is in Asia. I am going to make the change now, and get my colleague to test it when he comes into the office.

Will let you know if it makes a difference.

Thanks for your assistance.
0
Kevin TurnbullIT ManagerAuthor Commented:
Hi Pete

I tried your command of nat (internal,external)  dynamic interface

But it is incomplete. Did you mean

nat (internal,external) source dynamic any interface

Just because the command of

nat(internal,external)  dynamic interface

doesn't have a source address.
0
Pete LongTechnical ConsultantCommented:
?
no you don't need the source keyword?

object network OBJ-NAT-ALL
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

Are the commands I use on every firewall I build?
0
Kevin TurnbullIT ManagerAuthor Commented:
Hi Pete

I managed to solve the issue, after you mentioned the DNS look Up.

So the public DNS look up is pointing to 8.8.8.8 which is google and is on our Domain Controller. When we unplugged our old firewall the DC lost connection to the internet and was unable to do the Public DNS look up as the new ASA was on a different IP address.

Once we change the ASA's internal IP address to match that of the old firewall,  the DC was able to do the DNS look up.

A oversight on my side, but this also helped me to fix another issue I have been facing for a while. All working now.

Thanks for your assistance.
0
Kevin TurnbullIT ManagerAuthor Commented:
A user comment prompted me to look in a area which I overlooked previously. But doing a system diagram, I was able to pinpoint the issue and fix it.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Cisco

From novice to tech pro — start learning today.