2

I'm new into networking and I have a problem setting up ASA 5512 firewall. The problem is that I can't setup internet connection inside my network.

I've created two interfaces WAN with the public IP address (security level 0), and LAN with the ip of 192.168.35.4, security level 100. Actually, we are replacing the old router, and this one should take his address. I've added static route 0\0 to my default gateway, and I'm able to ping Google DNS server from the router, but can't from network computer. The network switch is also present on 192.168.35.254.

For the testing purpose I've changed WAN IP address to 192.168.99.1, and attached computer to it with IP 192.168.99.2, and when I try to ping it from the LAN interface, it does not return ping. I've also allowed ICMP inspection and created LAN to WAN NAT rule.

I would appreciate any help.

Result of the command: "show runn"

: Saved
:
ASA Version 9.1(2) 
!
hostname ciscoasa
enable password 0EnLStscpb84AAdM encrypted
names
!
interface GigabitEthernet0/0
 nameif WAN
 security-level 0
 ip address 192.168.99.1 255.255.255.0 
!
interface GigabitEthernet0/1
 nameif LAN
 security-level 100
 ip address 192.168.35.6 255.255.255.0 
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
 !
 interface GigabitEthernet0/3
 nameif LanTest
 security-level 0
 ip address 192.168.9.1 255.255.255.0 
!
interface GigabitEthernet0/4
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/5
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 management-only
 nameif Management
 security-level 100
 ip address 192.168.2.1 255.255.255.0 
!
boot system disk0:/asa912-smp-k8.bin
ftp mode passive
clock timezone CEST 1
clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00
dns domain-lookup WAN
dns domain-lookup LAN
dns server-group DefaultDNS
 name-server 208.67.222.222
 name-server 208.67.220.220
 name-server 8.8.8.8
 name-server 8.8.4.4
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network Bruce
 host 192.168.35.203
object network Buzz
 host 192.168.35.202
object network Exchange
 host 192.168.35.205
object network Fiona
 host 192.168.35.25
object network Mirror2
 host 192.168.35.24
object network Remy
 host 192.168.35.147
object network VOIP-Phone
 host 192.168.35.152
object service 81
 service tcp source eq 81 destination eq 81 
object service Fax-TCP
 service tcp source eq 5061 destination eq 5061 
object service Fax-UDP
 service udp source eq 5061 destination eq 5061 
object service Phone1
 service tcp source range sip 5090 destination range sip 5090 
object service Phone2
 service udp source range sip 5090 destination range sip 5090 
object service Phone3
 service udp source range 7000 7499 destination range 7000 7499 
object service Phone4
 service udp source range 9000 9049 destination range 9000 9049 
object service Phone5
 service udp source eq 10000 destination eq 10000 
object service SVN
 service tcp source eq 3690 destination eq 3690 
object service Sipgate
 service udp source eq sip destination eq sip 
object service Telavox
 service udp source eq sip destination eq sip 
object service Voiptalk
 service udp source eq sip destination eq sip 
object network Dug
 host 192.168.35.39
object network obj-0.0.0.0
 subnet 0.0.0.0 0.0.0.0
access-list WAN_cryptomap extended permit ip 192.168.35.0 255.255.255.0 192.168.11.0             255.255.255.0 
access-list WAN_cryptomap_1 extended permit ip 192.168.35.0 255.255.255.0 192.168.135.0 255.255.255.0 
access-list WAN_cryptomap_4 extended permit ip 192.168.35.0 255.255.255.0 10.176.0.0 255.240.0.0 
access-list WAN_cryptomap_2 extended permit ip 192.168.35.0 255.255.255.0 192.168.13.0 255.255.255.0 
access-list WAN_access_in extended permit tcp any interface WAN eq pptp 
access-list WAN_access_in extended permit object Telavox any interface WAN 
access-list global_access extended permit object Phone1 object Dug any 
access-list global_access extended permit object Phone2 object Dug any 
access-list global_access extended permit object Phone3 any any 
access-list global_access extended permit object Phone4 any any 
access-list global_access extended permit object Phone5 any any 
access-list global_access extended permit object Phone1 object VOIP-Phone any 
access-list global_access extended permit object Phone2 object VOIP-Phone any 
access-list global_access extended deny object Phone1 any any 
access-list global_access extended deny object Phone2 any any 
access-list global_access extended permit tcp object Exchange any eq smtp 
access-list global_access extended permit tcp object Exchange any eq pop3 
pager lines 24
logging asdm informational
mtu Management 1500
mtu WAN 1500
mtu LAN 1500
mtu LanTest 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any Management
icmp permit any LAN
asdm image disk0:/asdm-713.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
nat (LAN,WAN) after-auto source dynamic any interface
access-group WAN_access_in in interface WAN
access-group global_access global
route WAN 0.0.0.0 0.0.0.0 192.168.99.2 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication telnet console LOCAL 
aaa authentication enable console LOCAL 
aaa authorization command LOCAL 
aaa authorization exec LOCAL
http server enable
http 192.168.1.0 255.255.255.0 Management
http 192.168.0.0 255.255.0.0 Management
http 192.168.0.0 255.255.0.0 LAN
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

I've done what JJBurgess suggested and here is the output:

Result of the command: "packet-tracer input LAN tcp 192.168.45.2 80 192.168.99.2 80 detailed"

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   192.168.99.0    255.255.255.0   WAN

Phase: 2
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group LAN_access_in in interface LAN
access-list LAN_access_in extended permit ip any any 
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7fffa033ca70, priority=13, domain=permit, deny=false
    hits=1, user_data=0x7fff9b795140, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=LAN, output_ifc=any

Phase: 3
Type: NAT
Subtype: 
Result: ALLOW
Config:
nat (LAN,WAN) after-auto source dynamic any interface
Additional Information:
Dynamic translate 192.168.45.2/80 to 192.168.99.1/80
 Forward Flow based lookup yields rule:
 in  id=0x7fff9fdfa6a0, priority=6, domain=nat, deny=false
    hits=6, user_data=0x7fff9fb4e6a0, cs_id=0x0, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=LAN, output_ifc=WAN

Phase: 4
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7fff9eba4d20, priority=0, domain=nat-per-session, deny=false
    hits=19194, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=any, output_ifc=any

Phase: 5
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0x7fff9ff06120, priority=0, domain=inspect-ip-options, deny=true
    hits=7932, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=LAN, output_ifc=any

Phase: 6
Type: NAT
Subtype: rpf-check
Result: ALLOW
Config:
nat (LAN,WAN) after-auto source dynamic any interface
Additional Information:
 Forward Flow based lookup yields rule:
 out id=0x7fff9f52e430, priority=6, domain=nat-reverse, deny=false
    hits=2, user_data=0x7fffa05f92b0, cs_id=0x0, use_real_addr, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=LAN, output_ifc=WAN

Phase: 7
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0x7fff9eba4d20, priority=0, domain=nat-per-session, deny=false
    hits=19196, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=any, output_ifc=any

Phase: 8
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0x7fff9e391890, priority=0, domain=inspect-ip-options, deny=true
    hits=16734, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
    src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
    dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
    input_ifc=WAN, output_ifc=any

Phase: 9
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 17528, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: LAN
input-status: up
input-line-status: up
output-interface: WAN
output-status: up
output-line-status: up
Action: allow
Improve this question
0

2 Answers 2

Reset to default
1

in elevated mode, run the command:

packet-tracer input LAN tcp 192.168.35.203 80 192.168.99.2 80 detailed

and have a look through the output. It should give you an idea why the packets are being dropped, if indeed there is a problem with the configuration.

You can also run an capture on both interfaces to check if the packets are getting where you think they should be going by setting up an access list which matches the packets you want to capture, and applying to an interface as follows:

capture {capture-name} interface {interface-name} access-list {access-list name}

Improve this answer
2
  • true enough I suppose. Although since I cannot comment due to a lack of reputation, what can I do?
    – JJBurgess
    Feb 25, 2015 at 10:53
  • While you don't actually provide a specific answer, if edited a bit more could provide a more general troubleshooting approach to resolving the issue. While you aren't providing specific lines in his configuration to fix, sometimes giving the process to fix it themselves is more helpful to the OP as well as future users who find this question/answer.
    – YLearn
    Feb 25, 2015 at 19:03
2

Perhaps try a standard permit any any to see if you get some movement. If you do, then we can take a few steps at moving closer to your end goal.

Give this a try:

access-list ACL_INSIDE_TO_OUTSIDE extended permit ip any any
access-group ACL_INSIDE_TO_OUTSIDE in interface LAN

And for your computer that you have on the WAN side... if you're using Windows firewall or some other similar firewall on the computer, to disable it. =)

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.