3

My issue is this: I have a Cisco ASA which the INSIDE interface is set to DHCP lease IPs 10.1.10.104 - 254 ... I have a few static servers using the "lower" IP range (i.e. 10.1.10.11). The issue is that anything "lower" than .104 is blocked from accessing any network other than 10.1.10.0. It is also blocked from NAT rules attempting to forward port traffic IE PPTP through from the OUTSIDE network. I have included my running config below.

Result: input-interface: inside input-status: up input-line-status: up output-interface: outside output-status: up output-line-status: up Action: allow

    ASA Version 8.2(5) 
!

names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.1.10.100 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 74.xx.xx.xx 255.255.255.248 
!
ftp mode passive
object-group network DM_INLINE_NETWORK_1
 network-object 10.xx.xx.0 255.255.255.0
 network-object 10.xx.xx.0 255.255.255.0
access-list outside_access_in extended permit icmp any any 
access-list outside_1_cryptomap extended permit ip 10.1.10.0 255.255.255.0 object-group DM_INLINE_NETWORK_1 
access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 10.xx.xx.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 10.1.10.0 255.255.255.0 10.xx.xx.0 255.255.255.0 
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 10.1.10.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 74.xx.xx.xx 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.1.10.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac 
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac 
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac 
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac 
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac 
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac 
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac 
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac 
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs group5
crypto map outside_map 1 set peer xx.xx.xx.xx
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map interface outside
crypto isakmp enable inside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication crack
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 20
 authentication rsa-sig
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 30
 authentication pre-share
 encryption aes-256
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 40
 authentication crack
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 50
 authentication rsa-sig
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 60
 authentication pre-share
 encryption aes-192
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 70
 authentication crack
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 80
 authentication rsa-sig
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 90
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 100
 authentication crack
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 110
 authentication rsa-sig
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 120
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 130
 authentication crack
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 140
 authentication rsa-sig
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 150
 authentication pre-share
 encryption des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 170
 authentication pre-share
 encryption 3des
 hash sha
 group 5
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns 75.75.75.75 75.75.76.76
dhcpd auto_config outside
!
dhcpd address 10.1.10.104-10.1.10.254 inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
tunnel-group xx.xx.xx.xx type ipsec-l2l
tunnel-group xx.xx.xx.xx ipsec-attributes
 pre-shared-key xx
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
  inspect pptp 
  inspect icmp 
!
service-policy global_policy global
prompt hostname context 
no call-home reporting anonymous
: end

Is there anything I am obviously missing? I am a network noob, so please keep this in mind, and if more info is needed etc, please inform me as such ... For the sake of simplicity, lets use the single IP 10.1.10.11 as the "problem" IP.

#############EDIT############

I have added a traceroute per a suggestion from the answer below. Again I reiterate that I am a noob, so be gentle.

Result of the command: "packet-tracer input inside tcp 10.1.10.11 80 75.75.75.75  80"

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 2
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 3
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 4
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (inside) 1 10.1.10.0 255.255.255.0
  match ip inside 10.1.10.0 255.255.255.0 outside any
    dynamic translation to pool 1 (74.xx.xx.225 [Interface PAT])
    translate_hits = 841385, untranslate_hits = 182888
Additional Information:
Dynamic translate 10.1.10.11/80 to 74.xx.Xx.225/120 using netmask 255.255.255.255

Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 10.1.10.0 255.255.255.0
  match ip inside 10.1.10.0 255.255.255.0 inside any
    dynamic translation to pool 1 (No matching global)
    translate_hits = 0, untranslate_hits = 0
Additional Information:

Phase: 6
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 7
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 1635639, packet dispatched to next module

HOWEVER

This fails:

Result of the command: "packet-tracer input outside icmp 75.75.75.75 0 0 10.1.10.11 detailed"

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   10.1.10.0       255.255.255.0   inside

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: DROP
Config:
Implicit Rule
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xc95e4128, priority=0, domain=permit, deny=true
    hits=343309, user_data=0x9, cs_id=0x0, flags=0x1000, protocol=0
    src ip=0.0.0.0, mask=0.0.0.0, port=0
    dst ip=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: inside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule
13
  • What does a traceroute from one of the affected hosts to 75.75.75.75 look like? Commented Jan 14, 2014 at 1:20
  • Default gateway of the static hosts not 10.1.10.100?
    – Ricky
    Commented Jan 14, 2014 at 3:11
  • Traceroute to 75.75.75.75 fails at first hop (directly connected via bridged switch to ASA) Request timed out. From a non-affected IP it runs flawlessly. -- And the default gateway IS 10.1.10.100. The point of setting this up this way was to have DHCP addresses from 104-254 and static IPs from 99 down.
    – Zak
    Commented Jan 14, 2014 at 17:45
  • host-limits... forgot about those. Look at the asa's license (show license) for the number of allowed hosts. 5505's come in three flavors: 10, 50, and unlimited. When you hit the limit, it will stop allowing hosts through. (VPN hosts count)
    – Ricky
    Commented Jan 14, 2014 at 19:36
  • @RickyBeam -- I checked .. also in the ASDM .. It is an unlimited license 5505.
    – Zak
    Commented Jan 14, 2014 at 20:09

2 Answers 2

2

I see you have an access-list :access-list outside_access_in But idon't see it applied on the interface. I think you should have an Access-list for inside interface too, and applied to it. Permit icmp, http,https from inside and any other protocol you need. Then do a traceroute.

You can also try this command: packet-tracer see how to use it here: https://supportforums.cisco.com/docs/DOC-5796

This command can show you were your packets fail.


EDIT

So you need 2 ACL's , one for inside interface and one for outside. I see you already have one for outside but it is not applied to the interface. Like this :access-group outside_access_in in interface outside

Create an ACL for inside too, and apply it.

It is useless to test packet-tracet from outside to inside. like this :"packet-tracer input outside icmp 75.75.75.75 0 0 10.1.10.11"

this is because it will be always dropped becuae you don't have a static NAT mapping and an ACL entry perminting the traffic.

SO the first packet-tracer test is what we needed and it looks ok. We want to see that traffic coming form inside is forming a flow.The fireweall will permit the returning flow. (This is a statefull firewall)

So create an apply ACL for inside and outside and see if it works.

1
  • I almost understand what you are saying ... But not quite, so please have patience. I have run the command you suggested and edited my OP question. What exactly, if anything, can you see wrong with the output?
    – Zak
    Commented Jan 14, 2014 at 18:00
0

Lets go with the packet tracer 2 here, what are you trying to acheive? If someone is trying to access the webserver on the outside interface of the Firewall, it has to be a Public IP that you should checking the packet-tracer for. The firewall will drop the packet as it does not see a translation for the IP address that is present on the inside interface, hence the packet will be dropped.

So, first you need create a Static NAT or Static PAT for the internal IP address that should resolve the issue.

Static NAT: static (inside,outside) 74.xx.xx.xx 10.1.10.11

Static PAT ( lets assume the server on the inside interface is running web services): static (inside,outside) TCP 74.xx.xx.xx 80 10.1.10.11 80

Also, you would need to permit the traffic that you want come into this server on the inside, only the traffic that is initiated from the outside of the firewalls needs to be permitted, the traffic that is initiated from inside is termed secured and allowed to go from higher security zone to a lower security zone.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.