Solved

Cisco ASA Routing

Posted on 2014-12-18
8
125 Views
Last Modified: 2014-12-27
Hi All

We have a ASA 5515-X running 9.1(2) with ASDM 7.1(3)

I am doing a basic set up on it, so external and internal ports config with then a NAT rule and Access rule to just browse out to the web. It has a static route of 0.0.0.0 going to the ISP's gateway. The ASA is sitting in another country, so by having basic internet access I can then use a remote log in tool to finish the config.

I have set a temporary IP for the internal port. But when we try to test the config, we can Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

I am not sure what is causing the block. I have set up ASA 5510's in the same way and they work fine. But running into a road bock with this 5515-X.

I have attached the config for review,
ASA.log
0
Comment
Question by:TazzEE
  • 5
  • 3
8 Comments
 
LVL 57

Accepted Solution

by:
Pete Long earned 500 total points
ID: 40507042
>>Ping out to the internet (8.8.8.8) but cannot browse out. There is no internet access.

Ping from where? the ASA or an internal client? If its the latter is DNS working?

P
0
 

Author Comment

by:TazzEE
ID: 40507097
Hi Pete

I can ping out from a internal client. I believe DNS is working. The ASA is a replacement for a older Cisco 2811 which works fine.

I have set up the DNS server on the ASA and checked the forwarders on the DC as well and all looks good.

I just can't understand why the browsing isn't working. Even the Network status shows the internet connectivity is good.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507113
do this,
object network OBJ_GENERIC_ALL
no nat (internal,external) source dynamic OBJ_GENERIC_ALL interface
nat (internal,external)  dynamic interface

any difference?

PL
0
 

Author Comment

by:TazzEE
ID: 40507168
I am in the UK, and the ASA is in Asia. I am going to make the change now, and get my colleague to test it when he comes into the office.

Will let you know if it makes a difference.

Thanks for your assistance.
0
VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

 

Author Comment

by:TazzEE
ID: 40507318
Hi Pete

I tried your command of nat (internal,external)  dynamic interface

But it is incomplete. Did you mean

nat (internal,external) source dynamic any interface

Just because the command of

nat(internal,external)  dynamic interface

doesn't have a source address.
0
 
LVL 57

Expert Comment

by:Pete Long
ID: 40507810
?
no you don't need the source keyword?

object network OBJ-NAT-ALL
subnet 0.0.0.0 0.0.0.0
nat (inside,outside) dynamic interface

Are the commands I use on every firewall I build?
0
 

Assisted Solution

by:TazzEE
TazzEE earned 0 total points
ID: 40512775
Hi Pete

I managed to solve the issue, after you mentioned the DNS look Up.

So the public DNS look up is pointing to 8.8.8.8 which is google and is on our Domain Controller. When we unplugged our old firewall the DC lost connection to the internet and was unable to do the Public DNS look up as the new ASA was on a different IP address.

Once we change the ASA's internal IP address to match that of the old firewall,  the DC was able to do the DNS look up.

A oversight on my side, but this also helped me to fix another issue I have been facing for a while. All working now.

Thanks for your assistance.
0
 

Author Closing Comment

by:TazzEE
ID: 40519494
A user comment prompted me to look in a area which I overlooked previously. But doing a system diagram, I was able to pinpoint the issue and fix it.
0

Featured Post

VMware Disaster Recovery and Data Protection

In this expert guide, you’ll learn about the components of a Modern Data Center. You will use cases for the value-added capabilities of Veeam®, including combining backup and replication for VMware disaster recovery and using replication for data center migration.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Don’t let your business fall victim to the coming apocalypse – use our Survival Guide for the Fax Apocalypse to identify the risks and signs of zombie fax activities at your business.
If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now