1

ASA5510 without any extra services such as utm and using Comcast business internet.

Users stopped getting emails in middle of the night. That was our first indication. After checking things every computer had internet access except anything that was NAT'd. This included DNS server, exchange, web servers, etc. If I delete the NAT for a server it has internet. Our inside to outside is permitted any any. We do not filter it outgoing.

After trying a backup ASA with a previous config and it still not working I was pretty convinced it was Comcast. Since they wouldn't call us back I got a cheapy small business firewall, configured our Nats and viola. It all worked. Head scratcher!

So, I'm not sure how at 2 am in a company that only has 8-5 shift this happened at 2am and only to NAT'd computers. Tried two diffrent ASAs with two diffrent backup configs but works on a two hundred dollar firewall.

Comcast denies any changes.

: Hardware:   ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz  
:  
ASA Version 8.2(5)59  
!  
hostname My-Firewall  
domain-name mydomain.com  
enable password aaaaaaaaaa encrypted  
passwd aaaaaaaaaaaaa encrypted  
no names  
name 192.168.163.0 city1 description Main subnet for Fort Wayne  
name 192.168.164.0 city2 description Main subnet for city2  
name 192.168.10.0 IP_thiss description Subnet for IP thiss in city3  
name 192.168.160.0 city3 description Main city3 subnet  
name 192.168.160.94 city3_Enterprise_Manager description Voicserver1 Server in city3  
name 192.168.13.80 videothis_city3 description city3 video conference  
name 192.168.160.81 this_Communicator description this Communicator  
name 192.168.160.30 companyName-webconf description webconf server in city3   
 name 192.168.160.32 companyName-yabb description companyName-yabb    
name 192.168.160.31 companyNameweb description companyName web server in city3access-list Inside_nat0_outbound permit ip 10.44.84.0 255.255.252.0 172.16.199.0 255.255.255.224     
name 192.168.160.45 server_Server description FTP server on companyName-er01\  
name 90.84.51.39 stuff_Outside_Server description Used for stuff Software Incoming    
name 192.168.63.0 wf_Guest_Wifi description wf_Guest_Wifi  
name 192.168.244.0 city3_Guest_Wifi description city3_Guest_Wifi  
name 192.168.61.0 hgfd_Guest_Wifi description hgfd_Guest_Wifi  
name 192.168.62.0 Rich_Guest_Wifi description Rich_Guest_Wifi 
name 192.168.23.0 city3companyName-WIFI description Subnet buit city3 WiFi  
name 90.195.161.168 Comcast_Outside_Internet  
name 90.195.161.210 server1_Outside  
name 192.168.160.12 server2_Inside description Shiny the DNS server  
name 90.195.161.215 server_Outside  
name 10.10.40.1 othercompanyRouter  
name 90.195.161.218 othercompany_Outside  
name 192.168.163.80 videothis_wf description Fort Wayne video conf  
name 192.168.13.0 city3_videothis_Network description videothis Video subnet in city3  
name 90.195.161.214 External-companyName-WEB description FOR EXTERNAL SERVICE APP  
name 192.168.160.13 Internal-companyName-WEB description SERVER USED FOR EXTERNAL SERVICE APP  
name 192.168.160.15 server1_Server description server1 server  
name 90.195.161.216 wf_videothis_Outside  
name 90.195.161.217 city3videothis_Outside  
name 192.168.160.14 server_server3-Server description companyName-util  
name 90.195.161.212 server2_Outside  
name 172.16.162.0 VPNwfNetwork  
name 172.16.161.0 VPNcity3Network  
name 12.47.243.162 BigCompany_Main_Address description Firewall and VPN address on BigCompany circuit  
name 4.53.56.162 A-4.53.56.162 description us-baas.acronis.com  
name 192.168.165.80 Site4_videothis description Site4 conf room pc with videothis software  
name 216.165.24.0 fun_outgoing_1  
name 63.128.21.0 fun_outgoing_2  
name 199.199.41.113 fun_outgoing_  3
name 199.199.31.0 funcast_incoming_a  nd_outgoing_1 description server1 Filter incoming
name 199.199.30.0 funcast_incoming_and_outgoing_2 description server1 filter incoming  
name 205.244.110.0 funcast_incoming_and_outgoing_3 description server1 filter incoming  
name 205.244.111.0 funcast_incoming_and_outgoing_4 description server1 filter incoming  
name 244.141.187.121 country_Signal_Outside description Offsite Backups  
name 192.168.165.0 Site4 description Main subnet for Site4  
name 192.168.160.96 thisSystem_Inside.96  
name 192.168.160.97 thisSystem_Inside.97  
name 192.168.160.98 thisSystem_Inside.98  
name 90.195.161.219 thisSystem_Outside.219 
name 90.195.161.220 thisSystem_Outside.220 
name 90.195.161.221 thisSystem_Outside.221
!
interface Ethernet0/0
 shutdown
 nameif OLD-T1s
 security-level 0
 ip address 244.132.192.165 255.255.255.224 
!
interface Ethernet0/1
 description Lan that goes to HP switch but ultimatley to main router.
 nameif Inside
 security-level 100
 ip address 10.44.104.16 255.255.255.0 
!
interface Ethernet0/2
 description Comcast Internet
 nameif Outside
 security-level 0
 ip address 90.195.161.169 255.255.255.240 
!
interface Ethernet0/3
 description 10mb internet circuit through BigCompany.
 nameif BigCompanyinternet
 security-level 0
 ip address 12.47.243.162 255.255.255.248 
!
interface Management0/0
 nameif manage
 security-level 100
 ip address 192.168.99.1 255.255.252.0 
 management-only
!
no ftp mode passive
dns domain-lookup OLD-T1s
dns domain-lookup Inside
dns domain-lookup Outside
dns server-group DefaultDNS
 name-server 192.168.160.16
 name-server 192.168.163.16
 name-server 192.168.165.16
 domain-name mydomain.com
dns server-group myoutsidedomain.com
 name-server 192.168.160.12
 domain-name myoutsidedomain.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group network Guest_Wifi_Networks
 description Traffic Identified for all wifi guest networks
 network-object 192.168.61.0 255.255.255.0
 network-object 192.168.62.0 255.255.255.0
 network-object 192.168.63.0 255.255.255.0
 network-object 192.168.244.0 255.255.255.0
object-group service stuff tcp-udp
 description stuff Software incoming
 port-object eq 34789
 port-object range 49152 65535
 port-object eq sip
 port-object eq www
object-group protocol DM_INLINE_PROTOCOL_1
 protocol-object udp
 protocol-object tcp
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
object-group service AllPortOpen
 description AllPortOpen
 service-object ip 
object-group network wfallNetworks
 network-object 192.168.163.0 255.255.255.0
object-group service videothis_h323
 service-object tcp range 3230 3243 
 service-object tcp eq h323 
 service-object udp range 3230 3285 
object-group network videothisBlocked
 network-object host 103.28.37.174
 network-object host 119.68.244.35
 network-object host 121.14.133.164
 network-object host 121.14.133.35
 network-object host 122.248.32.134
 network-object host 123.30.145.28
 network-object host 162.243.223.37
 network-object host 184.168.68.152
 network-object host 185.14.232.171
 network-object host 187.22.8.22
 network-object host 187.84.144.21
 network-object host 188.40.95.125
 network-object host 191.241.39.5
 network-object host 197.231.244.24
 network-object host 199.168.112.38
 network-object host 201.151.179.6
 network-object host 202.93.176.243
 network-object host 203.162.79.155
 network-object host 206.225.80.25
 network-object host 199.166.134.62
 network-object host 208.43.10.227
 network-object host 208.70.56.60
 network-object host 209.197.191.75
 network-object host 209.197.191.77
 network-object host 209.41.161.161
 network-object host 210.242.195.5
 network-object host 210.245.90.163
 network-object host 210.91.78.161
 network-object host 216.165.99.1
 network-object host 24.227.199.37
 network-object host 38.109.36.53
 network-object host 41.221.5.198
 network-object host 90.30.119.83
 network-object host 90.57.71.147
 network-object host 54.160.152.3
 network-object host 54.247.191.248
 network-object host 58.83.237.14
 network-object host 67.199.143.73
 network-object host 69.65.17.180
 network-object host 76.180.236.54
 network-object host 78.129.231.92
 network-object host 78.83.63.129
 network-object host 85.125.67.66
 network-object host 85.214.155.83
 network-object host 85.214.246.93
 network-object host 93.180.63.163
object-group service DM_INLINE_SERVICE_1
 service-object tcp-udp eq 8443 
 service-object tcp eq ftp 
 service-object tcp eq ftp-data 
 service-object tcp eq https 
object-group network vpncity3Network
 network-object 172.16.161.0 255.255.255.0
object-group network vpnwfNetwork
 network-object 172.16.162.0 255.255.255.0
object-group network country_Signal_Incoming_Group
 description name said these IP's are needed inbound for backups to US Signal
 network-object 184.175.140.128 255.255.255.128
 network-object 184.175.183.128 255.255.255.128
 network-object host 244.141.171.160
 network-object host 244.141.171.161
 network-object host 244.141.171.162
 network-object host 244.141.171.163
 network-object host 244.141.171.170
 network-object host 244.141.171.171
 network-object host 244.141.171.172
 network-object host 244.141.171.173
 network-object host 244.141.171.175
 network-object host 244.141.171.190
 network-object host 244.141.171.60
 network-object host 244.141.171.61
 network-object host 244.141.171.62
 network-object 244.141.187.112 255.255.255.240
object-group network funcast_incoming_all_ranges
 description These are the ranges funcast uses for incoming. There are two additional outgoing only but we don't block outgoing. Those are 63.128.21.0/24  199.199.41.113/32 216.165.24.0/24
 network-object 205.244.110.0 255.255.255.0
 network-object 205.244.111.0 255.255.255.0
 network-object 199.199.30.0 255.255.255.0
 network-object 199.199.31.0 255.255.255.128
object-group network funcast_outgoing_all_ranges
 network-object 205.244.110.0 255.255.255.0
 network-object 205.244.111.0 255.255.255.0
 network-object 199.199.30.0 255.255.255.0
 network-object 199.199.31.0 255.255.255.128
 network-object host 199.199.41.113
 network-object 216.165.24.0 255.255.255.0
 network-object 63.128.21.0 255.255.255.0
object-group service DM_INLINE_SERVICE_2
 service-object tcp range 3998 3999 
 service-object tcp eq 5566 
 service-object tcp range 6800 6802 
 service-object udp eq 20001 
 service-object udp range 5004 5007 
 service-object udp range 50098 50508 
 service-object udp eq 5567 
 service-object udp range 6004 6261 
 service-object udp range 6604 7039 
 service-object udp eq tftp 
 service-object tcp eq 5570 
object-group service DM_INLINE_SERVICE_0
 service-object tcp range 3998 3999 
 service-object tcp eq 5566 
 service-object tcp eq 5570 
 service-object tcp range 6800 6802 
 service-object udp eq 20001 
 service-object udp range 5004 5007 
 service-object udp range 50098 50508 
 service-object udp eq 5567 
 service-object udp range 6004 6261 
 service-object udp range 6604 7039 
 service-object udp eq tftp 
object-group service DM_INLINE_SERVICE_4
 service-object tcp range 3998 3999 
 service-object tcp eq 5566 
 service-object tcp eq 5570 
 service-object tcp range 6800 6802 
 service-object udp eq 20001 
 service-object udp range 5004 5007 
 service-object udp range 50098 50508 
 service-object udp eq 5567 
 service-object udp range 6004 6261 
 service-object udp range 6604 7039 
 service-object udp eq tftp 
object-group service DM_INLINE_SERVICE_3
 service-object tcp-udp eq domain 
 service-object tcp eq www 
 service-object tcp eq https 
access-list Inside_nat0_outbound extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 10.44.88.0 255.255.252.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.160.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.2.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.163.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.164.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.165.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 10.44.104.0 255.255.252.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.10.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.13.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.15.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 10.10.0.0 255.255.0.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.23.0 255.255.255.0 172.16.199.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 172.16.199.0 255.255.255.0 
access-list Outside_access_in remark To Block Ping In and Out
access-list Outside_access_in extended deny icmp any any 
access-list Outside_access_in extended permit udp any any eq isakmp 
access-list outbound extended deny ip any host 216.178.39.74 
access-list outbound extended deny ip any host 216.178.38.131 
access-list outbound extended deny ip any host 216.178.38.129 
access-list outbound extended deny ip any host 216.178.38.130 
access-list outbound extended deny ip any host 216.178.39.15 
access-list outbound extended deny ip any host 216.178.39.14 
access-list outbound extended deny ip any host 216.178.39.13 
access-list outbound extended deny ip any host 216.178.39.12 
access-list outbound extended deny ip any host 216.178.39.11 
access-list outbound extended deny tcp any host 216.178.39.16 eq www 
access-list outbound extended deny ip any host 216.178.39.16 
access-list outbound extended permit ip any any 
access-list outbound extended permit ip any host 90.84.51.39 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.165.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 172.16.16.0 255.255.240.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.160.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.163.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.164.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.13.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.14.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 10.44.0.0 255.255.0.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.15.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0 
access-list companyNamevpn_splitTunnelAcl remark Guest WiFi
access-list companyNamevpn_splitTunnelAcl standard permit 192.168.244.0 255.255.255.0 
access-list outside extended permit icmp any any 
access-list Inside_ACL extended permit ip any any 
access-list Inside_ACL extended permit icmp any any 
access-list Inside_ACL extended permit tcp host 192.168.160.15 object-group funcast_outgoing_all_ranges eq smtp 
access-list Inside_ACL extended permit ip any host 244.141.187.121 
access-list 101 extended permit ip 192.168.13.0 255.255.255.0 any 
access-list dsl extended permit ip any any 
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_3 any host 90.195.161.212 
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_4 any host 90.195.161.221 
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_0 any host 90.195.161.220 
access-list Outside_ACL extended permit tcp object-group funcast_incoming_all_ranges host 90.195.161.210 eq smtp 
access-list Outside_ACL remark WebMail
access-list Outside_ACL extended permit tcp any host 90.195.161.210 eq https 
access-list Outside_ACL extended permit icmp any any 
access-list Outside_ACL extended permit ip any host 90.195.161.218 
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_2 any host 90.195.161.219 
access-list Outside_ACL extended permit object-group DM_INLINE_SERVICE_1 any host 90.195.161.215 
access-list Outside_ACL extended permit tcp any host 90.195.161.214 eq https 
access-list Outside_ACL extended permit ip host 244.141.187.121 any 
access-list Outside_ACL remark To Block Hackers that have been hitting our network. Edit the object videothisBlocked to add more.
access-list Outside_ACL extended deny ip object-group videothisBlocked any 
access-list Outside_ACL remark Malicious BigCompanyack on wf videothis. From Hungary.Added 4/13/2015 Rodney Tyler
access-list Outside_ACL extended deny ip host 91.83.236.154 any 
access-list Outside_ACL remark Enable this rule to allow Fort Wayne videothis to accept calls
access-list Outside_ACL extended permit object-group videothis_h323 any host 90.195.161.216 inactive 
access-list Outside_ACL remark Enable this rule to allow city3 videothis to accept calls
access-list Outside_ACL extended permit object-group videothis_h323 any host 90.195.161.217 inactive 
access-list Outside_ACL extended permit ip host 90.84.51.39 any 
access-list Outside_ACL extended permit object-group DM_INLINE_PROTOCOL_1 object-group country_Signal_Incoming_Group any range 7770 8000 
access-list outside_1_cryptomap extended permit ip 10.44.104.0 255.255.255.0 192.168.163.0 255.255.255.0 
access-list inside_nat0_outbound extended permit ip 10.44.104.0 255.255.255.0 192.168.163.0 255.255.255.0 
access-list qos extended permit ip host 90.195.161.216 any 
access-list qos extended permit ip host 90.195.161.217 any 
access-list AndroidVPN_Split_ACL remark All Sites
access-list AndroidVPN_Split_ACL standard permit 192.168.0.0 255.255.0.0 
access-list AndroidVPN_Split_ACL remark Making sure Firewall and any other 10.44.104 interface passes traffic
access-list AndroidVPN_Split_ACL standard permit 10.44.104.0 255.255.255.0 
access-list Outside_1_cryptomap extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0 
access-list Outside_1_cryptomap extended permit ip 172.16.162.0 255.255.255.0 172.16.161.0 255.255.255.0 
access-list Outside_2_cryptomap extended permit ip 172.16.161.0 255.255.255.0 172.16.162.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 12.47.243.160 255.255.255.248 
access-list BigCompanyvpn_splitTunnelAcl standard permit 172.16.161.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.160.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.163.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.164.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.165.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 172.16.199.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.10.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.13.0 255.255.255.0 
access-list BigCompanyvpn_splitTunnelAcl standard permit 192.168.23.0 255.255.255.0 
access-list BigCompanyinternet_access_in extended permit icmp any any 
access-list testing webtype permit url any log default
pager lines 20
logging enable
logging buffer-size 1000000
logging buffered notifications
logging history errors
logging asdm notifications
logging from-address administrator@myoutsidedomain.com
logging ftp-server 244.132.192.171 21 companyName *****
mtu OLD-T1s 1500
mtu Inside 1500
mtu Outside 1500
mtu BigCompanyinternet 1500
mtu manage 1500
ip local pool VPNipPool 172.16.199.129-172.16.199.254 mask 255.255.255.128
ip local pool companyNamevpn 172.16.199.1-172.16.199.25 mask 255.255.255.224
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp deny any OLD-T1s
icmp deny any Outside
asdm image disk0:/asdm-621.bin
no asdm history enable
arp timeout 14400
global (Outside) 101 interface
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 101 0.0.0.0 0.0.0.0 dns
static (Inside,Outside) 90.195.161.217 192.168.13.80 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.218 10.10.40.1 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.214 192.168.160.13 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.210 192.168.160.15 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.215 192.168.160.14 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.216 192.168.163.80 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.220 192.168.160.96 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.219 192.168.160.98 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.221 192.168.160.97 netmask 255.255.255.255 
static (Inside,Outside) 90.195.161.212 192.168.160.12 netmask 255.255.255.255 
access-group Outside_access_in in interface OLD-T1s
access-group Inside_ACL in interface Inside
access-group Outside_ACL in interface Outside
access-group BigCompanyinternet_access_in in interface BigCompanyinternet
route Outside 0.0.0.0 0.0.0.0 90.195.161.222 1
route Inside 10.10.0.0 255.255.0.0 192.168.160.1 1
route Inside 172.16.16.0 255.255.240.0 192.168.160.1 1
route Inside 172.16.161.0 255.255.255.0 192.168.160.1 1
route Inside 172.16.161.0 255.255.255.0 172.16.161.1 1
route Inside 192.168.160.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.163.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.164.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.165.0 255.255.255.0 192.168.160.1 1
route Inside 172.16.199.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.10.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.13.0 255.255.255.0 192.168.13.1 1
route Inside 192.168.15.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.23.0 255.255.255.0 192.168.23.1 1
route Inside 192.168.61.0 255.255.255.0 192.168.61.1 1
route Inside 192.168.62.0 255.255.255.0 192.168.62.1 1
route Inside 192.168.244.0 255.255.255.0 192.168.244.1 1
route Inside 192.168.70.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.71.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.72.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.73.0 255.255.255.0 192.168.160.1 1
route Inside 192.168.74.0 255.255.255.0 192.168.160.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server TACACS+ protocol tacacs+
 max-failed-BigCompanyempts 2
aaa-server RADIUS protocol radius
 max-failed-BigCompanyempts 2
aaa-server RADIUS (Inside) host 192.168.160.16
 timeout 5
 key *****
aaa-server auth protocol radius
 max-failed-BigCompanyempts 2
aaa-server auth (Inside) host 192.168.160.16
 key *****
aaa authentication ssh console LOCAL 
http server enable
http server idle-timeout 60
http 192.0.0.0 255.0.0.0 Inside
http 192.168.0.0 255.255.0.0 manage
http 192.168.0.0 255.255.0.0 Inside
snmp-server host Inside 192.168.160.14 community ***** version 2c
no snmp-server location
no snmp-server contact
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
snmp-server enable traps syslog
snmp-server enable traps ipsec start stop
snmp-server enable traps entity config-change fru-insert fru-remove
snmp-server enable traps remote-access session-threshold-exceeded
sysopt noproxyarp OLD-T1s
sysopt noproxyarp Inside
sysopt noproxyarp Outside
sysopt noproxyarp BigCompanyinternet
sysopt noproxyarp manage
auth-prompt prompt Login 
auth-prompt accept Your login is accepted 
auth-prompt reject Your login information was rejected by the Radius Server 
REMOVED CRYPTO
client-update enable
vpn-addr-assign local reuse-delay 10
telnet 192.168.0.0 255.255.0.0 Inside
telnet 0.0.0.0 0.0.0.0 Inside
telnet timeout 60
ssh 10.44.104.0 255.255.255.0 Inside
ssh 192.168.0.0 255.255.0.0 Inside
ssh 0.0.0.0 0.0.0.0 Inside
ssh 0.0.0.0 0.0.0.0 Outside
ssh timeout 60
console timeout 60
management-access Inside
dhcpd address 192.168.99.2-192.168.99.254 manage
dhcpd enable manage
!
priority-queue Inside
priority-queue Outside
threat-detection basic-threat
threat-detection statistics
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
ntp authenticate
ntp server 192.168.160.16 source Inside prefer
ssl encryption rc4-sha1 aes256-sha1 aes128-sha1 3des-sha1 des-sha1 rc4-md5
ssl trust-point ASDM_TrustPoint0 Outside
ssl trust-point ASDM_TrustPoint0 OLD-T1s vpnlb-ip
ssl trust-point ASDM_TrustPoint0 OLD-T1s
REMOVED VPN POLICIES AND QOS
!
!
policy-map type inspect dns preset_server2_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_server2_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
  inspect ip-options 
policy-map qos
 description voip and videothis
 class qos
  priority
policy-map type inspect esmtp tls-allow
 parameters
  no mask-banner
  allow-tls
!
service-policy global_policy global
service-policy qos interface Inside
service-policy qos interface Outside

: end
  • I'm confused, because it appears all your computers are Natted to the Internet. So you made no changes to your firewall when the problem started? – Ron Trunk Oct 29 '17 at 4:25
  • Exactly! I can't understand it. I've spent a ridiculous amount of time on this. I would have bet a paycheck that the ASA was bad because it's such a strange issue but we have two spares we've tried. The the little zyxel firewall Nats fine. In the gui if I put a server in using the public server option (which builds the nat and rules) the nat doesn't work and that device can no longer get to the Internet by ip or name. I did a packet trace in asdm using one of those nat'd server addresses as the source and it shows successful to 8.8.8.8. Head scratcher! – Fixitrod Oct 29 '17 at 13:12
  • To clarify, everything goes to the internet until it has a public ip nat'd to it. When that nat and rules are built that specific computer can no longer get to the Internet in or out and it should. If I put a computer directly to the Comcast router bypassing the firewall as a test and set the ip address of it to any public ip that's owned the computer has internet and I can access it remotely. Everything works fine with a diffrent firewall in place as well. I was convinced some hardware associated with nat could be bad. After trying two spares and backups I'm obviously wrong. – Fixitrod Oct 29 '17 at 13:46
  • What do you get in the log? Try changing your logging to "logging buffered informational" and see what messages you get when you try to ping 8.8.8.8. Also, just to clarify, ALL your devices are natted. Most are dynamic, and the ones you are having trouble with are static. – Ron Trunk Oct 29 '17 at 14:33
  • I'll have to hook it back up to test and check logs. Its in an office 2 hours from me and I'll need to schedule it. But I will see what I can do. – Fixitrod Oct 29 '17 at 16:12
0

Our company bought new Sophos firewalls and doesn't want me to troubleshoot the ASAs anymore. I'll put this as an answer to keep it from popping up unless there is another way. Hoping this issue doesn't raise its head with the new firewalls! Thank you for your help.

| improve this answer | |
  • Sorry to hear that but I hope everything will be fine! – Hung Tran Nov 16 '17 at 14:26
  • We never did find a resolution. We bought 2 more ASAs to test with the same issue. The Sophos XGs did not have the same issue. – Fixitrod Oct 11 '18 at 1:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.