I hate posting things like this, but we're backed into a corner here. We recently had a new client ask us to set up an ASA for their branch office 800 miles away. A colleague and I spent last night staring at the config and can't see anything blatantly wrong with it, but the ASA is currently in-place at the new office and refuses to pass traffic.

We can ping the inside default gateway from the LAN and the ISP's gateway from the ASA, just no LAN->WAN. 0/1 is the outside connection we're currently using with being the gateway of last resort. We're looking at swapping physical today, but other than that, we're at a loss. Any help you all could offer would be greatly appreciated. Also flame for putting this into production without testing first is welcome.


hostname NY-ASA5200
domain-name tiddlywinks.com
enable password .OQUvNlAd8LFUGsq7R9h encrypted
passwd 2KFQNnbNIUdI.2TKYOUR encrypted
interface GigabitEthernet0/0
nameif FIBER
security-level 0
ip address
interface GigabitEthernet0/1
nameif OUTSIDE
security-level 0
ip address
interface GigabitEthernet0/2
nameif INSIDE
security-level 100
ip address
interface GigabitEthernet0/3
no nameif
no security-level
no ip address
interface Management0/0
no nameif
no security-level
no ip address
ftp mode passive
dns server-group DefaultDNS
domain-name tiddlywinks.com
object network inside-subnet
object network outside_IP
access-list inside_out_acl extended permit ip any any
access-list inside_out_acl extended permit icmp any any
pager lines 24
mtu FIBER 1500
mtu Regis 1500
mtu INSIDE 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
object network inside-subnet
nat (INSIDE,OUTSIDE) dynamic interface
route OUTSIDE 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sla monitor 123
type echo protocol ipIcmpEcho interface FIBER
num-packets 4
frequency 15
sla monitor schedule 123 life forever start-time now
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
track 1 rtr 123 reachability
telnet INSIDE
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address INSIDE
dhcpd enable INSIDE
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ssl encryption aes256-sha1
class-map inspection_default
match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
service-policy global_policy global
prompt hostname context
profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic 
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin
    Feb 19, 2018 at 5:46

2 Answers 2


Try this way:

object network inside-subnet subnet nat (INSIDE,OUTSIDE) dynamic interface

  • Can't comment on Andrey's answer, but the ASA splits up those lines for some reason. object network inside-subnet subnet object network inside-subnet nat (INSIDE,OUTSIDE) dynamic interface Jun 16, 2017 at 15:34
  • Per what Michael says, would there be a reason these two parameters for 'object network inside-subnet' would be split in the config or are is it functionally identical to what you have written here? Jun 16, 2017 at 15:46
  • They are functionally identical. What the ASA does when it prints the config out, is to repeat the object network line twice in order to consolidate all of the NAT configuration in one section, and all of the object configuration in another section. However you can enter both portions in one chunk as shown by @andrey-prokhorov as you're already in the proper sub-configuration mode. Jun 16, 2017 at 17:48

We ended up doing two things to resolve this issue.

  1. Replacing cables and changing the interfaces on the ASA.
  2. Removing failover settings from the configuration. Particularly these lines.

sla monitor 123

sla monitor schedule 123 life forever start-time now

track 1 rtr 123 reachability

  • You should acept your answer so that the question doesn't keep popping up forever, looking for an answer.
    – Ron Maupin
    Jul 16, 2017 at 21:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.