Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Cisco ASA Routing

Posted on 2014-12-18
8
Medium Priority
?
132 Views
Last Modified: 2014-12-27
Hi All

We have a ASA 5515-X running 9.1(2) with ASDM 7.1(3)

I am doing a basic set up on it, so external and internal ports config with then a NAT rule and Access rule to just browse out to the web. It has a static route of 0.0.0.0 going to the ISP's gateway. The ASA is sitting in another country, so by having basic internet access I can then use a remote log in tool to finish the config.

I have set a temporary IP for the internal port. But when we try to test the config, we can Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

I am not sure what is causing the block. I have set up ASA 5510's in the same way and they work fine. But running into a road bock with this 5515-X.

I have attached the config for review,
ASA.log
0
Comment
Question by:TazzEE
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 3
8 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 1500 total points
ID: 40507042
>>Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

Ping from where? the ASA or an internal client? If its the latter is DNS working?

P
0
 

Author Comment

by:TazzEE
ID: 40507097
Hi Pete

I can ping out from a internal client. I believe DNS is working. The ASA is a replacement for a older Cisco 2811 which works fine.

I have set up the DNS server on the ASA and checked the forwarders on the DC as well and all looks good.

I just can't understand why the browsing isn't working. Even the Network status shows the internet connectivity is good.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507113
do this,
object network OBJ_GENERIC_ALL
no nat (internal,external) source dynamic OBJ_GENERIC_ALL interface
nat (internal,external)  dynamic interface

any difference?

PL
0
Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

 

Author Comment

by:TazzEE
ID: 40507168
I am in the UK, and the ASA is in Asia. I am going to make the change now, and get my colleague to test it when he comes into the office.

Will let you know if it makes a difference.

Thanks for your assistance.
0
 

Author Comment

by:TazzEE
ID: 40507318
Hi Pete

I tried your command of nat (internal,external)  dynamic interface

But it is incomplete. Did you mean

nat (internal,external) source dynamic any interface

Just because the command of

nat(internal,external)  dynamic interface

doesn't have a source address.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507810
?
no you don't need the source keyword?

object network OBJ-NAT-ALL
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

Are the commands I use on every firewall I build?
0
 

Assisted Solution

by:TazzEE
TazzEE earned 0 total points
ID: 40512775
Hi Pete

I managed to solve the issue, after you mentioned the DNS look Up.

So the public DNS look up is pointing to 8.8.8.8 which is google and is on our Domain Controller. When we unplugged our old firewall the DC lost connection to the internet and was unable to do the Public DNS look up as the new ASA was on a different IP address.

Once we change the ASA's internal IP address to match that of the old firewall,  the DC was able to do the DNS look up.

A oversight on my side, but this also helped me to fix another issue I have been facing for a while. All working now.

Thanks for your assistance.
0
 

Author Closing Comment

by:TazzEE
ID: 40519494
A user comment prompted me to look in a area which I overlooked previously. But doing a system diagram, I was able to pinpoint the issue and fix it.
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

When speed and performance are vital to revenue, companies must have complete confidence in their cloud environment.
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
Michael from AdRem Software outlines event notifications and Automatic Corrective Actions in network monitoring. Automatic Corrective Actions are scripts, which can automatically run upon discovery of a certain undesirable condition in your network.…
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…

722 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question