I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that "Oh I get it" moment yet, so it's likely this is a very basic misconfiguration.

I am trying to set up a Cisco ASA 5505 to be connected with a public IP address on one interface, and to have the second interface connect to our internal network. Right now our internal network is on, and the public IP we have from the ISP is in the 125.x.x.x range.

I have set up 3 interfaces on the ASA,

  • Inside

    Ports 1-6
    Sec Level 100
  • Outside

    IP: 125.x.x.x
    Port 0
    Sec Level 0
  • Management

    Port 7
    Restricted to management
    Restrict flow to Outside (had to do this for licensing reasons)

I have an access rule on the firewall that allows IP traffic from any source on the inside network to any less secure network (there is one for both IPv4 and 6).

With the internet-facing router connected to port 0, I connect a computer to port 1 with IP, Mask and gateway Using this PC I can ping but no further - I cannot ping the public IP address or

If I connect the same PC directly to the router and assign it the public IP address directly I can access the internet no problem. I believe that the issue here is that I need to add some static routes to show the path from inside<->outside, but I just do not grok them well enough to know how to structure them. Any help or suggestions would be very much appreciated.

Edit: See below the running config, with some redactions.

: Saved
ASA Version 8.2(1) 
hostname AUS-FW-01
domain-name =============.com.au
enable password ============= encrypted
passwd ============= encrypted
name CNC-network
name LAN-network
name LEGACY-network
name RANDD-network
name WIRELESS-network
name InternalGateway
name DCServer
name MUVS-TP description Trueform Print Server
interface Vlan1
 nameif inside
 security-level 100
 ip address 
interface Vlan2
 nameif outside
 security-level 0
 ip address 125.x.x.10 
interface Vlan12
 no forward interface Vlan2
 nameif Management
 security-level 0
 ip address 
interface Ethernet0/0
 switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
 switchport access vlan 12
ftp mode passive
clock timezone EST 10
dns domain-lookup outside
dns server-group DefaultDNS
 name-server =============
 name-server =============
 domain-name =============.com.au
same-security-traffic permit intra-interface
access-list outside_access_in remark Email access
access-list outside_access_in extended permit tcp any LEGACY-network eq smtp 
access-list outside_access_in remark ActiveSync Email Access
access-list outside_access_in extended permit tcp any LEGACY-network eq https 
access-list outside_access_in remark Pronto Trueform Printing
access-list outside_access_in extended permit tcp any LEGACY-network eq lpd 
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu Management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1
static (inside,outside) tcp interface smtp DCServer smtp netmask 
static (inside,outside) tcp interface https DCServer https netmask 
static (inside,outside) tcp interface lpd MUVS-TP lpd netmask 
access-group outside_access_in in interface outside
route inside LAN-network 1
route inside LEGACY-network InternalGateway 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
http LAN-network inside
http Management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username ============= password ============= store-local
dhcpd auto_config outside

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
service-policy global_policy global
prompt hostname context 
: end
asdm location LAN-network inside
asdm location WIRELESS-network inside
asdm location RANDD-network inside
asdm location CNC-network inside
asdm location LEGACY-network inside
asdm location InternalGateway inside
asdm location DCServer inside
asdm location MUVS-TP inside
no asdm history enable

PS: I wasn't sure if this was a better fit here or on SF. I have no problem with it being moved.

  • 1
    Is the mask on the outside interface really What did the ISP assign you? Mar 7, 2014 at 0:14
  • @BrettLykins The ISP technician came out yesterday and set up the router, it was pre-configured with 125.x.x.9. When she tested it and showed me it was working for me to signoff she did so by connecting her laptop to it and setting her IP to 125.x.x.10, her mask to and her default gateway to 125.x.x.9. I have made the assumption those were the correct values based on her using them. Is it unlikely for a public IP to have such a wide network? Mar 7, 2014 at 0:22
  • 1
    Ok, so odds are that the subnetmask should be (a /30). That is the usual size of an interface assignment and would make sense based on the .9 and .10 addresses. Back to your question, yes you would need a route and also a NAT configuration. Can you post the entire configuration of the ASA? Obviously sanitized of passwords etc. Mar 7, 2014 at 0:38
  • I've just discovered how to do that in GUI. Will do now (it's file>show running config in new window, right?) Mar 7, 2014 at 0:56
  • 1
    The technician did that because it was simple to configure for a simple test. She/you wouldn't do that IRL.
    – Ron Trunk
    Mar 7, 2014 at 1:22

1 Answer 1


OK, after looking at your configuration, you are missing one statement:

route outside 125.x.x.9

This tells the firewall to forward all Internet traffic to the ISP's router at 125.x.x.9

  • Ron & @BrettLykins, you're both absolute legends. Posting this through my newly configured connection. You've already basically done my job for me, so I feel terrible asking, but do you mind explaining the role of the address and mask there? Is it just "all addresses on all networks" essentially? Mar 7, 2014 at 1:40
  • Also - on other sites I would normally wait a day to mark an answer so as not to deter other, possibly helpful to others, answers. As this is just a "I missed a glaring misconfig and this is the single answer", should I just mark you now? Mar 7, 2014 at 1:43
  • If you want to mark it as correct, I won't object ;-p The statement is called a "default route." It instructs the firewall to forward any traffic that does not belong to any of the local subnets to the ISP router. The part means "match any network." There's a more technical explanation, but it won't fit in the comments section.
    – Ron Trunk
    Mar 7, 2014 at 1:56
  • I probably wouldn't grasp the more technical one anyway heh. Thanks again! Mar 7, 2014 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.