2

First time doing a network, I'm a software guy normally. I am setting up a network to share and internet connections to multiple properties. The goal is to segment each property onto its own VLAN.

I have a gateway with IP 192.168.1.254/24 that I can use to get to the internet. There is a Cisco ASA 5512X connected on the first port (with IP 192.168.1.253/24). Its IP is from a DHCP reservation. For all the sub-nets, this ASA acts as the DHCP server. The next port on the ASA is connected to an HP A5820X switch. The ports have been configured for the needed VLANs.

The switch has a trunk port with a Cisco Mobility Express WiFi AP who hosts a few WLANs.

I have IPs being handed out properly, but my VLANs cannot reach the internet. I see the ASA being hit, and messages like "Built outbound UDP connection..." but the clients on these sub-nets cannot reach the internet.

A rough diagram of the network:

Diagram

ASA Version 9.1(2) 
!
hostname firewall
domain-name revenance.us
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 9eeFjmhLBXqRF2up encrypted
names
!
interface GigabitEthernet0/0
 description Gateway Access
 nameif outside
 security-level 0
 ip address dhcp setroute 
 dhcprelay server 192.168.1.254
!
interface GigabitEthernet0/1
 description Inside Trunk Interface
 flowcontrol send on
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0 
!
interface GigabitEthernet0/1.1
 description Default VLAN1 (for HP Switch)
 vlan 1
 nameif Default-VLAN
 security-level 100
 ip address 10.0.1.1 255.255.255.0 
!
interface GigabitEthernet0/1.2
 description 9831 datacentre VLAN
 vlan 2
 nameif 9831-DC-VLAN
 security-level 10
 ip address 10.0.2.1 255.255.255.0 
!
interface GigabitEthernet0/1.18
 description 9818 LAN Segment
 shutdown
 vlan 18
 nameif 9818-VLAN
 security-level 100
 ip address 10.0.18.1 255.255.255.0 
!
interface GigabitEthernet0/1.31
 description 9831 LAN Segment
 vlan 31
 nameif 9831-VLAN
 security-level 100
 ip address 10.0.31.1 255.255.255.0 
!
interface GigabitEthernet0/1.34
 description 9834 LAN Segment
 vlan 34
 nameif 9834-VLAN
 security-level 100
 ip address 10.0.34.1 255.255.255.0 
!
interface GigabitEthernet0/1.35
 description 9835 LAN Segment
 shutdown
 vlan 35
 nameif 9835-VLAN
 security-level 100
 ip address 10.0.35.1 255.255.255.0 
!
interface GigabitEthernet0/1.75
 description 9875 LAN Segment
 shutdown
 vlan 75
 nameif 9875-VLAN
 security-level 100
 ip address 10.0.75.1 255.255.255.0 
!
banner exec Please be sure to save any changes with write.
banner login Connected to Cisco ASA - $(hostname)
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
dns server-group DefaultDNS
 domain-name revenance.us
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network A_
object network revenance.us
 fqdn v4 revenance.us
object network ISP_Gateway
 host 192.168.1.254
 description AT&T Gateway
object network Gateway-Network
 subnet 192.168.1.0 255.255.255.0
object-group network Inside-Networks
 network-object 10.0.0.0 255.255.255.0
 network-object 10.0.1.0 255.255.255.0
 network-object 10.0.18.0 255.255.255.0
 network-object 10.0.2.0 255.255.255.0
 network-object 10.0.31.0 255.255.255.0
 network-object 10.0.34.0 255.255.255.0
 network-object 10.0.35.0 255.255.255.0
 network-object 10.0.75.0 255.255.255.0
access-list outside_access_in remark Allow all to DC
access-list outside_access_in extended permit ip interface outside 10.0.2.0 255.255.255.0 
access-list inside_access_out extended permit ip any any 
access-list global_access extended permit ip any any 
access-list global_access extended permit ip object-group Inside-Networks object Gateway-Network 
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu 9831-DC-VLAN 1500
mtu 9818-VLAN 1500
mtu 9831-VLAN 1500
mtu 9834-VLAN 1500
mtu 9835-VLAN 1500
mtu 9875-VLAN 1500
mtu Default-VLAN 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
icmp permit any outside
icmp permit any inside
asdm history enable
arp timeout 14400
no arp permit-nonconnected
access-group outside_access_in in interface outside
access-group inside_access_out out interface inside
access-group global_access global
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
no user-identity enable
user-identity default-domain LOCAL
no user-identity action mac-address-mismatch remove-user-ip
http server enable
http 192.168.1.0 255.255.255.0 outside
http 10.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd domain revenance.us
dhcpd auto_config outside
!
dhcpd address 10.0.0.10-10.0.0.250 inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!
dhcpd auto_config outside interface 9831-DC-VLAN
!
dhcpd address 10.0.18.10-10.0.18.250 9818-VLAN
dhcpd auto_config outside interface 9818-VLAN
dhcpd enable 9818-VLAN
!
dhcpd address 10.0.31.10-10.0.31.250 9831-VLAN
dhcpd auto_config outside interface 9831-VLAN
dhcpd enable 9831-VLAN
!
dhcpd address 10.0.1.10-10.0.1.250 Default-VLAN
dhcpd auto_config outside interface Default-VLAN
dhcpd enable Default-VLAN
!
no threat-detection basic-threat
no threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username sinman password uXtx7p2Ftlk.2ajD encrypted
!
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
!
prompt hostname state context 
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email [email protected]
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly 28
  subscribe-to-alert-group configuration periodic monthly 28
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:2979836264ef9f78dba4a6f01c759115
: end
Improve this question
8
  • 1
    My ASA is a bit rusty but I don’t immediately see a NAT translation or default route to the internet. Update: default route might be provided by dhcp. One level of NAT might be provided by internet gateway, but if you don’t double-nat on the ASA, the internet gateway needs to route 10-net back to your ASA outside interface (hard if that comes from dhcp).
    – Darrell Root
    Nov 2, 2019 at 21:21
  • DHCP does provide the default gateway (autoconf from the outside interface, which comes from the gateway). ASDM's "Routes" sections shows a row - Type:DEFAULT, Interface, 0.0.0.0 0.0.0.0 [1/0] via 192.168.254
    – Revenant
    Nov 2, 2019 at 21:40
  • Thanks for confirming. So how does the internet gateway route return traffic to the 10-net?
    – Darrell Root
    Nov 2, 2019 at 21:42
  • It does not... it probably isn't even aware of the network...is that probably why? Though pinging other VLANs isn't working just yet.
    – Revenant
    Nov 2, 2019 at 21:46
  • That is my guess. If you can’t change that device, you can enable NAT with overloading on the ASA so to egress traffic comes from gig 0/0 IP address. Then replies get to the ASA. Alternative is to get static IP for asa outside interface and static route 10-net back to that IP. That’s a better solution because it avoids double-nat.
    – Darrell Root
    Nov 2, 2019 at 21:51

3 Answers 3

Reset to default
3

Your access lists are totally wrong. outside_access_in only allows the outside interface's address -- which will never be the source for inbound traffic -- through, to an internal network; and it won't work anyway as traffic does not flow from lower to higher security levels. The global access only allows inside networks to talk to the gateway network. Until you fully understand the role of a global access rule, don't use one. Use the packet-tracer command to see the effects of your configuration -- acl's, nat's, etc.

And then there's the issue of NAT. The external AT&T (Uverse?) gateway doesn't know anything about those internal networks. And as they're 10.x, it can't -- 10/8 is invalid/reserved within the uverse network. You don't want to be exposing the internal networks anyway. (I don't recall there being anything in the limited GUI to add routes.)

Also, it's odd to have ip configured on the base interface for a trunk. What vlan does that traffic belong to? (whatever the external switch has set for the native vlan - if any.)

Improve this answer
2
  • PS: If this is uverse, get ready to learn to bypass their gateway. The connection limit will kill you with many people behind it. My office of 10 people haven't run into it, but a great deal of our connections appear as one - VPN tunnel.
    – Ricky
    Nov 2, 2019 at 22:27
  • I concur with access-lists not implementing any sort of useful security policy. Of course, you need connectivity to work before troubleshooting ACLs. At least the NAT overload will protect you from ingress traffic (do you really want to allow all traffic to your DC?). But you have not blocked communications between your internal subnets yet. Ah well, one step at a time. Not bad for a software guy: ASA is not that friendly to newcomers ;-)
    – Darrell Root
    Nov 2, 2019 at 22:29
2

Enabling PAT via the NAT Rules for each VLAN interface allowed connections to the internet.

Improve this answer
2
  • Cool. I'd like to see the resulting config. Cisco documentation is awful regarding the simplest NAT/PAT config and it's hard to write without a box and some trial-and-error.
    – Darrell Root
    Nov 2, 2019 at 22:21
  • 1
    To be honest, "new nat" is a bloated, incomprehensible mess. What was two lines in pre-8.3 turns into a dozen and a hour of cursing to get it to do it correctly. Order. Matters. (for the record, my perfectly understandable 34 lines in 8.2 ballons to 144 lines of spaghetti in v9)
    – Ricky
    Nov 2, 2019 at 22:41
1

Like I said, my ASA is rusty and I don't have a box to play on, but here's a draft NAT configuration to try out. Be nice to get something working without ISP intervention, even if it is suboptimal.

object network default-vlan
  subnet 10.0.1.0 255.255.255.0
  nat (Default-VLAN, outside) dynamic interface
object network 9831-vlan
  subnet 10.0.2.0 255.255.255.0
  nat (9831-DC-VLAN, outside) dynamic interface

(repeat for each internal vlan once tested successfully)

Useful troubleshooting command: show xlate

(Removed some incorrect config...thx Ricky Beam)

Here's some Cisco config examples, but sadly they leave out the simplest case which is what we need. Ugh. https://www.cisco.com/c/en/us/td/docs/security/asa/asa98/configuration/firewall/asa-98-firewall-config/nat-reference.html#ID-2091-00000007

Improve this answer
1
  • 2
    ip nat [inside|outside] is an IOS configuration. PIX/ASA never did that.
    – Ricky
    Nov 2, 2019 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.