2

I hate posting things like this, but we're backed into a corner here. We recently had a new client ask us to set up an ASA for their branch office 800 miles away. A colleague and I spent last night staring at the config and can't see anything blatantly wrong with it, but the ASA is currently in-place at the new office and refuses to pass traffic.

We can ping the inside default gateway from the LAN and the ISP's gateway from the ASA, just no LAN->WAN. 0/1 is the outside connection we're currently using with 10.19.130.177 being the gateway of last resort. We're looking at swapping physical today, but other than that, we're at a loss. Any help you all could offer would be greatly appreciated. Also flame for putting this into production without testing first is welcome.

ASA5200:

!
hostname NY-ASA5200
domain-name tiddlywinks.com
enable password .OQUvNlAd8LFUGsq7R9h encrypted
passwd 2KFQNnbNIUdI.2TKYOUR encrypted
names
!
interface GigabitEthernet0/0
shutdown
nameif FIBER
security-level 0
ip address 172.16.0.1 255.255.255.0
!
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address 10.19.130.190 255.255.255.240
!
interface GigabitEthernet0/2
nameif INSIDE
security-level 100
ip address 192.168.220.1 255.255.255.0
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
dns server-group DefaultDNS
domain-name tiddlywinks.com
object network inside-subnet
subnet 192.168.220.0 255.255.255.0
object network outside_IP
host 10.19.130.190
access-list inside_out_acl extended permit ip any any
access-list inside_out_acl extended permit icmp any any
pager lines 24
mtu FIBER 1500
mtu Regis 1500
mtu INSIDE 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
!
object network inside-subnet
nat (INSIDE,OUTSIDE) dynamic interface
route OUTSIDE 0.0.0.0 0.0.0.0 10.19.130.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho 8.8.8.8 interface FIBER
num-packets 4
frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
!
track 1 rtr 123 reachability
telnet 192.168.220.0 255.255.255.0 INSIDE
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.220.100-192.168.220.150 INSIDE
dhcpd enable INSIDE
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption aes256-sha1
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
call-home
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic 
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
 Cryptochecksum:1bf8d350a86639071a01cf5ee2782a42
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 5:46
1

Try this way:

object network inside-subnet subnet 192.168.220.0 255.255.255.0 nat (INSIDE,OUTSIDE) dynamic interface

  • Can't comment on Andrey's answer, but the ASA splits up those lines for some reason. object network inside-subnet subnet 192.168.220.0 255.255.255.0 object network inside-subnet nat (INSIDE,OUTSIDE) dynamic interface – Michael Lubert Jun 16 '17 at 15:34
  • Per what Michael says, would there be a reason these two parameters for 'object network inside-subnet' would be split in the config or are is it functionally identical to what you have written here? – Will VanDyke Jun 16 '17 at 15:46
  • They are functionally identical. What the ASA does when it prints the config out, is to repeat the object network line twice in order to consolidate all of the NAT configuration in one section, and all of the object configuration in another section. However you can enter both portions in one chunk as shown by @andrey-prokhorov as you're already in the proper sub-configuration mode. – Brett Lykins Jun 16 '17 at 17:48
1

We ended up doing two things to resolve this issue.

  1. Replacing cables and changing the interfaces on the ASA.
  2. Removing failover settings from the configuration. Particularly these lines.

sla monitor 123

sla monitor schedule 123 life forever start-time now

track 1 rtr 123 reachability

  • You should acept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Jul 16 '17 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.