I am new to Cisco ASA and ASDM. Struggling with difference from IOS devices. Network layout is as follows:
AWS VPC -- IPsec tunnel -- ASA-5505 -- LAN
- IPsec tunnel is up.
- AWS can reach LAN connected devices.
- LAN connected devices can reach the internet.
However I have these two problems:
- LAN interface of ASA cannot ping to Internet.
- SLA monitoring isn't working. (Maybe related to point 1?)
Below I have inserted most of my running-config(and route table). I removed the crypto config and I have hid some octets of WAN addresses with xxx. Hopefully there is enough configuration here to be helpful in troubleshooting. If some additional information would be helpful please ask.
(Sorry, there was probably a better way to format the running-config below.)
ciscoasa# show running-config : Saved : ASA Version 9.1(2)8 ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 ! interface Vlan1 nameif inside security-level 100 ip address 192.168.0.1 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address xxx.152.29.xxx 255.255.255.240 ! ftp mode passive object network inside-subnet-1 subnet 192.168.0.0 255.255.255.0 object network AWS-inside-subnet subnet 172.19.254.128 255.255.255.128 object network NETWORK_OBJ_192.168.0.0_24 subnet 192.168.0.0 255.255.255.0 object-group protocol DM_INLINE_PROTOCOL_1 protocol-object ip protocol-object icmp access-list outside_cryptomap extended permit object-group DM_INLINE_PROTOCOL_1 192.168.0.0 255.255.255.0 object AWS-inside-subnet pager lines 24 logging enable logging asdm informational mtu outside 1500 mtu inside 1500 no failover icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 no arp permit-nonconnected nat (inside,outside) source static NETWORK_OBJ_192.168.0.0_24 NETWORK_OBJ_192.168.0.0_24 destination static AWS-inside-subnet AWS-inside-subnet ! object network inside-subnet-1 nat (inside,outside) dynamic interface route outside 0.0.0.0 0.0.0.0 xxx.152.29.xxx 1 http server enable http 192.168.0.0 255.255.255.0 inside no snmp-server location no snmp-server contact sla monitor 1 type echo protocol ipIcmpEcho 172.19.254.129 interface outside frequency 30 sla monitor schedule 1 life forever start-time now ! ssh 192.168.0.0 255.255.255.0 inside ssh timeout 20 ssh key-exchange group dh-group1-sha1 console timeout 0 ! ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp inspect ip-options inspect icmp ! : end ciscoasa# show route Gateway of last resort is xxx.152.29.xxx to network 0.0.0.0 C xxx.152.29.xxx 255.255.255.240 is directly connected, outside C 192.168.0.0 255.255.255.0 is directly connected, inside S* 0.0.0.0 0.0.0.0 [1/0] via xxx.152.29.xxx, outside ciscoasa#