2

Background: I am setting up a network for a local church I attend. The setup will be:

Currently ATT DSL --> Motorola 3801HGV set in transparent (bridging) mode -->outside interface of ASA5506 (configured for DHCP from DSL modem) -->Inside interface of 5506 (172.16.0.2 IP) --> routed interface on Cisco 3750 (Gi1/0/3).

The 3750 has 3 private networks. All networks can talk to each other without issue. All networks can ping the 172.16.0.2 IP (inside interface of ASA5506). Those three private networks are:

10.1.1.0/24
10.1.2.0/24
10.1.3.0/24

Note: I have single area OSPF running on the 3750 that performs my routing. I have default information originate configured there as well.

I currently have NAT configured on my ASA so that when traffic leaves the outside interface, it is PAT-ed to the external ISP IP (108.x.x.x). I ran packet-tracer to confirm - and packet tracer says it is allowed out - and shows it PAT-ed to the 108.x.x.x IP.

The problem: None of my 10.x.x.x networks can get out to the Internet. If i plug directly into the ATT 5031NV with a statically assigned 192.168.1.x IP (that's the DHCP Pool range the 5031nv gives out) - I can get out to the Internet with no issues.

I found that I can also not ping my default (ISP) gateway from my Cisco ASA. See below with updated (11/5/2015) config. I made several changes based on comments from this thread.

Relevant config on Cisco 3750:

SRPC-CORE-OFFICE#sho run | s router ospf
 router ospf 1
   passive-interface default
   no passive-interface GigabitEthernet1/0/3
   network 10.1.1.0 0.0.0.255 area 1
   network 10.1.2.0 0.0.0.255 area 1
   network 10.1.3.0 0.0.0.255 area 1

SRPC-CORE-OFFICE#sho ip route

Gateway of last resort is not set

      10.0.0.0/8 is variably subnetted, 6 subnets, 2 masks
C        10.1.1.0/24 is directly connected, Vlan100
L        10.1.1.1/32 is directly connected, Vlan100
C        10.1.2.0/24 is directly connected, Vlan120
L        10.1.2.1/32 is directly connected, Vlan120
C        10.1.3.0/24 is directly connected, Vlan130
L        10.1.3.1/32 is directly connected, Vlan130
      172.16.0.0/16 is variably subnetted, 2 subnets, 2 masks
C        172.16.0.0/24 is directly connected, GigabitEthernet1/0/3
L        172.16.0.1/32 is directly connected, GigabitEthernet1/0/3
S     192.168.0.0/16 is directly connected, GigabitEthernet1/0/3
S     192.168.5.0/24 is directly connected, GigabitEthernet1/0/3

! !

SRPC-CORE-OFFICE#sho ip int br | ex un
    Interface              IP-Address      OK? Method Status            Protocol
    Vlan100                10.1.1.1        YES NVRAM  up                    up      
    Vlan120                10.1.2.1        YES NVRAM  up                    up      
    Vlan130                10.1.3.1        YES NVRAM  up                    up    
    GigabitEthernet1/0/3   172.16.0.1      YES NVRAM  up                    up 

! !

SRPC-CORE-OFFICE#sho vlan br | i active
    100  MANAGEMENT                       active 
    120  SRPC_WIFI                        active 
    130  SRPC_DATA                        active 

Cisco ASA5506 relevant config:

SRPC-FW-01# sho run nat
        !
        object network obj_any
         nat (dmzTest,outside) dynamic interface

router ospf 1
 network 7.0.1.0 255.255.255.0 area 1
 network 10.1.1.10 255.255.255.255 area 1
 network 192.168.1.0 255.255.255.0 area 1
 log-adj-changes
 default-information originate

!
route dmzTest 10.1.0.0 255.255.224.0 172.16.0.1 1
!
!
SRPC-FW-01# sh int ip br 
Interface                  IP-Address      OK? Method Status            Protocol
GigabitEthernet1/1         108.225.177.202 YES DHCP   up                    up  
GigabitEthernet1/2         172.16.0.2      YES CONFIG up                    up  

!
!
SRPC-FW-01# sho nameif
       Interface                Name                     Security
       GigabitEthernet1/1       outside                    0
       GigabitEthernet1/2       dmzTest                  100
        !

access-list dmzTest-in extended permit tcp any any 
access-list dmzTest-in extended permit icmp any any 
access-list dmzTest-out extended permit tcp any any 
access-list management-in extended permit ip any any 
access-list management-out extended permit ip any any 
access-list OutsideATT-in extended permit ip any any 
access-list OutsideATT-out extended permit ip any any 
access-list dmztest-out extended permit icmp any any 
access-list outside_inbound_to_SRPC extended deny ip any any 
access-list outside_inbound_to_SRPC extended permit ip host 108.225.176.1 any 
access-list outside_outbound_to_INET extended permit ip 108.225.176.0 255.255.252.0 any 
access-list outside_outbound_to_INET extended permit ip any any 
!
!
!   
access-group outside_inbound_to_SRPC in interface outside
access-group outside_outbound_to_INET out interface outside
access-group dmzTest-in in interface dmzTest
access-group dmzTest-out out interface dmzTest
access-group OutsideATT-in in interface OutsideATT
access-group OutsideATT-out out interface OutsideATT
access-group management-in in interface management
access-group management-out out interface management
!

SRPC-FW-01# sho route
    Gateway of last resort is 108.225.176.1 to network 0.0.0.0

    S*    0.0.0.0 0.0.0.0 [1/0] via 108.225.176.1, outside
    S        10.1.0.0 255.255.224.0 [1/0] via 172.16.0.1, dmzTest
    C        108.225.176.0 255.255.252.0 is directly connected, outside
    L        108.225.177.202 255.255.255.255 is directly connected, outside
    C        172.16.0.0 255.255.255.0 is directly connected, dmzTest
    L        172.16.0.2 255.255.255.255 is directly connected, dmzTest
  • 1
    Not directly related to your problem, but do you really want OSPF hellos going out to the user subnets or the cable modem? You should probably just do a passive-interface default and a no passive-interface <int> for the interface of the OSPF neighbor. Also, rather than trying to specifically list every interface in OSPF, just do a network 0.0.0.0 255.255.255.255 area 1 to get all the directly attached interfaces. I'm curious about the choice of area 1. With a single area, that will work, but area 0 is a better choice if you need to expand later. – Ron Maupin Oct 19 '15 at 16:17
  • 1
    Also, you don't want to originate the default route on the 3750. Leave that to the ASA, and remove the static default route from the 3750. The 3750 should learn the default route from the ASA and use that one. As it stands, you have the 3750 telling the ASA that it has the default route, and the ASA is telling the 3750 it has the default route. There should be only one default route with a dynamic routing protocol. – Ron Maupin Oct 19 '15 at 16:23
  • 2
    I'd go one step farther and say with one switch and a firewall, a static route (s)would be fine. Remove OSPF altogether. – Ron Trunk Oct 19 '15 at 16:30
  • Thanks for the comments, guys - that definitely helps. This is the first network i've stood up from the ground up, so i'll make those changes next time I get a chance to work on this stuff. Any comments about the NAT setup? – Jonathan Oct 19 '15 at 16:38
  • Could you post the configuration for the ACLs dmzTest-in and dmzTest-out? I'm not seeing that in your configuration. Also, you have your manual NAT configured with a pat-pool, but you only give it one address (interface). I would remove the pat-pool keyword, since it isn't currently doing anything. In fact, I would remove that whole statement, because you have an AutoNAT statement that is accomplishing exactly what you need it to. – Eddie Oct 20 '15 at 1:11
3

First, OSPF is not necessary (or recommended) for such a tiny network. I run much larger networks and still don't bother with dynamic routing.

Second, never, ever, route to a broadcast interface (ie. ip route 0.0.0.0 0.0.0.0 GigabitEthernet1/0/3) BTW, that's proxy-arp; I'm 1000% certain that is not what you want.

Third, AT&T's 3801 does not have a "bridge mode". And those modems have a particularly nasty bit of brain damage where the IP:MAC table is one-to-one -- a MAC can have only one IP and v.v., which means with a static block each IP must go to a different device.

| improve this answer | |
  • Thanks - I'll look into the not routing to a broadcast interface part. ATT 3801 has a 'DMZ' or 'pinhole' mode that allows it to appear bridged (thought technically not fully bridged): forums.att.com/t5/Third-Party-Devices/… That's how my ASA is able to obtain the 108.x.x.x IP via DHCP when plugged into the 3801. When you say the 3801 lets a MAC only have one IP - are you saying that NAT definitely won't work on this? I've found instances where people have used Cisco routers (28xx/29xx) and it works? – Jonathan Oct 19 '15 at 21:01
  • I am all too well aware of AT&T's brand of Stupid(tm). Your ASA should work, but only ONE IP will ever be usable -- either the DHCP "passthru" address, or one address from a routed pool. Yes, your route should go to an address, not an interface. You're using DHCP so that route statement will have no effect once DHCP receives an address. (unless, for some reason, it didn't provide a gateway) – Ricky Beam Oct 19 '15 at 23:23
0

As an update: I had a coworker come work on this - and she was able to change the 'Public-Private NAT Mappings and Device IP Allocation' options on the ATT Cable modem so that instead of my 'outside' interface getting the public 108.x.x.x IP - it pulled a 192.168.x.x IP from the ATT modem. The options were:

Settings > LAN > LAN IP Address Allocation

  • Device: [My firewall]
  • Device Status: DHCP RENEW 3
  • FIREWALL: DISABLED
  • Address Assignment: Public (select WAN IP Mapping)
  • WAN IP Mapping: Router WAN IP Address (default)
  • Cascaded Router: No

Right when that option changed, I shut/no shut my ASA outside interface and was able to get out. If anyone wants further logs/configs etc. I can post.

| improve this answer | |
  • You should accept your answer so that the question doesn't keep popping up looking for an answer. – Ron Maupin Dec 16 '15 at 3:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.