5

I think it is a similar case like this one. The only problem is that here I have a dynamic IP from the ISP, which gets updated from dhcp.

The asa can ping outside, however the inside hosts on vlan1 cannot ping internet IP addresses (eg. google).

This is my config:

ASA Version 9.2(3)4
!
hostname myname
enable password aaa encrypted
passwd aaaa encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.2 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address dhcp setroute
!
boot system disk0:/asa923-4-k8.bin
ftp mode passive
clock timezone CET 1
clock summer-time CET recurring last Sun Mar 2:00 last Sun Oct 3:00
object network obj_any
 subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-741.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpoint _SmartCallHome_ServerCA
 no validation-usage
 crl configure
crypto ca trustpoint ASDM_Launcher_Access_TrustPoint_0
 enrollment self
 fqdn none
 subject-name CN=192.168.1.26,CN=sergioasa
 keypair ASDM_LAUNCHER
 crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
 certificate ca ***cert stuff***
  quit
crypto ca certificate chain ASDM_Launcher_Access_TrustPoint_0
 certificate ***cert stuff***
  quit
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcprelay server 192.168.1.1 outside
dhcprelay enable inside
dhcprelay setroute inside
dhcprelay timeout 60
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl trust-point ASDM_Launcher_Access_TrustPoint_0
username sergio password aaaa encrypted
!
!
prompt hostname context
call-home reporting anonymous
Cryptochecksum:chesumnumbers

I think probably a route is missing... but how to add a route that sends all the outside traffic to vlan2 instead than to a precise IP address?

After adding:

object network obj_any
 nat (inside,outside) dynamic interface

I run:

packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed

And I got:

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         via 192.168.0.1, outside

Phase: 2
Type: NAT
Subtype:
Result: ALLOW
Config:
object network obj_any
 nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 192.168.1.100/323 to 192.168.0.12/323
 Forward Flow based lookup yields rule:
 in  id=0xcd238b10, priority=6, domain=nat, deny=false
        hits=1, user_data=0xcd02f3c0, cs_id=0x0, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=outside

Phase: 3
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false
        hits=810, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 4
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Forward Flow based lookup yields rule:
 in  id=0xcc9bf968, priority=0, domain=inspect-ip-options, deny=true
        hits=1341, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=inside, output_ifc=any

Phase: 5
Type: NAT
Subtype: per-session
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xcc34e8e8, priority=0, domain=nat-per-session, deny=false
        hits=812, user_data=0x0, cs_id=0x0, reverse, use_real_addr, flags=0x0, protocol=6
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=any, output_ifc=any

Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
 Reverse Flow based lookup yields rule:
 in  id=0xcc9d68d0, priority=0, domain=inspect-ip-options, deny=true
        hits=1075, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0
        src ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0
        dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=0, dscp=0x0
        input_ifc=outside, output_ifc=any

Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1249, packet dispatched to next module
Module information for forward flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_tcp_normalizer
snp_fp_translate
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Module information for reverse flow ...
snp_fp_tracer_drop
snp_fp_inspect_ip_options
snp_fp_translate
snp_fp_tcp_normalizer
snp_fp_adjacency
snp_fp_fragment
snp_ifc_stat

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

On the ISR(dhcp server) I have the following routing table:

Gateway of last resort is not set

     10.0.0.0/24 is subnetted, 1 subnets
C       10.11.0.0 is directly connected, Loopback0
C    192.168.1.0/24 is directly connected, BVI1

On the ASA the routing table is:

Gateway of last resort is 192.168.0.1 to network 0.0.0.0

S*    0.0.0.0 0.0.0.0 [1/0] via 192.168.0.1, outside
C        192.168.0.0 255.255.255.0 is directly connected, outside
L        192.168.0.12 255.255.255.255 is directly connected, outside
C        192.168.1.0 255.255.255.0 is directly connected, inside
L        192.168.1.2 255.255.255.255 is directly connected, inside
Improve this question

2 Answers 2

Reset to default
5

If the ASA can ping the internet then routing on the firewall is fine.

Although I did noticed I can't see a NAT statement to nat your traffic from your inside to the outside address

Apply the NAT under your object.

object network obj_any
nat (inside,outside) dynamic interface

If this doesn't resolve your issue please post the output from the following command


packet-tracer input inside tcp 192.168.1.100 323 8.8.8.8 80 detailed

Improve this answer
12
  • still didn't work. I added the info on the question
    – Pikk
    Commented Apr 17, 2015 at 17:24
  • Ah the outside address isn't a IPv4 Public address. possibly why you didn't need to NAT but from the config it was hard to see. As you can see from the packet-tracer its looking up the next-hop route fine and sending it to 192.168.0.1 is this the correct next-hop?. Is the next-hop your ISP router? I assume he's configured to NAT your traffic appropriately if so?
    – Smithy2k3
    Commented Apr 17, 2015 at 17:51
  • On ethernet 0/0 there is attached a cable modem that gives private class IPv4 addresses... but it's an address on another network. Now it receives 192.168.0.12, the inside hosts have 192.168.1.x
    – Pikk
    Commented Apr 17, 2015 at 17:53
  • Ok but we know for sure the firewall is allowing the traffic through i suppose you need to confirm the next-hop is correct? Im guessing the NAT may still be required so your cable modem knows where to send traffic back to (i.e the firewall) unless it has a static route back to your ASA
    – Smithy2k3
    Commented Apr 17, 2015 at 17:56
  • The next hop is working fine by default. If I connect clients directly to the cable modem they receive 192.168.0.x IP and can surf the net. If I attach to that cable modem other routers, such as linksys or Cisco ISR, they also work fine... and that ISR doesn't have any NAT or ROUTE in the config. I am wondering that there could be an issue with the DHCP server config... now that ISR is attached to the ASA and servers as DHCP server, and the hosts on the ASA are getting the IP from that DHCP server. They receive 192.168.1.1 as default gateway. Maybe it's wrong
    – Pikk
    Commented Apr 17, 2015 at 18:02
3

To fix ICMP try this

       class-map inspection_default
        match default-inspection-traffic
       policy-map global_policy
        class inspection_default
         inspect icmp
       service-policy global_policy global
Improve this answer
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.