7

I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that "Oh I get it" moment yet, so it's likely this is a very basic misconfiguration.

I am trying to set up a Cisco ASA 5505 to be connected with a public IP address on one interface, and to have the second interface connect to our internal network. Right now our internal network is on 192.168.1.0/24, and the public IP we have from the ISP is in the 125.x.x.x range.

I have set up 3 interfaces on the ASA,

  • Inside

    IP: 192.168.1.3
    Mask: 255.255.255.0
    Ports 1-6
    Sec Level 100
    
  • Outside

    IP: 125.x.x.x
    Mask: 255.0.0.0
    Port 0
    Sec Level 0
    
  • Management

    IP: 10.0.0.1
    Mask: 255.255.255.0
    Port 7
    Restricted to management
    Restrict flow to Outside (had to do this for licensing reasons)
    

I have an access rule on the firewall that allows IP traffic from any source on the inside network to any less secure network (there is one for both IPv4 and 6).

With the internet-facing router connected to port 0, I connect a computer to port 1 with IP 192.168.1.20, Mask 255.255.255.0 and gateway 192.168.1.3. Using this PC I can ping 192.168.1.3 but no further - I cannot ping the public IP address or 8.8.8.8.

If I connect the same PC directly to the router and assign it the public IP address directly I can access the internet no problem. I believe that the issue here is that I need to add some static routes to show the path from inside<->outside, but I just do not grok them well enough to know how to structure them. Any help or suggestions would be very much appreciated.

Edit: See below the running config, with some redactions.

: Saved
:
ASA Version 8.2(1) 
!
hostname AUS-FW-01
domain-name =============.com.au
enable password ============= encrypted
passwd ============= encrypted
names
name 10.61.76.0 CNC-network
name 10.61.73.0 LAN-network
name 192.168.1.0 LEGACY-network
name 10.61.75.0 RANDD-network
name 10.61.74.0 WIRELESS-network
name 10.61.73.5 InternalGateway
name 192.168.1.200 DCServer
name 192.168.1.214 MUVS-TP description Trueform Print Server
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 192.168.1.3 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 125.x.x.10 255.255.255.252 
!
interface Vlan12
 no forward interface Vlan2
 nameif Management
 security-level 0
 ip address 10.0.0.1 255.255.255.0 
 management-only
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
 switchport access vlan 12
!
ftp mode passive
clock timezone EST 10
dns domain-lookup outside
dns server-group DefaultDNS
 name-server =============
 name-server =============
 domain-name =============.com.au
same-security-traffic permit intra-interface
access-list outside_access_in remark Email access
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq smtp 
access-list outside_access_in remark ActiveSync Email Access
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq https 
access-list outside_access_in remark Pronto Trueform Printing
access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq lpd 
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu Management 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) tcp interface smtp DCServer smtp netmask 255.255.255.255 
static (inside,outside) tcp interface https DCServer https netmask 255.255.255.255 
static (inside,outside) tcp interface lpd MUVS-TP lpd netmask 255.255.255.255 
access-group outside_access_in in interface outside
route inside LAN-network 255.255.255.0 10.61.79.2 1
route inside LEGACY-network 255.255.255.0 InternalGateway 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 10.61.79.0 255.255.255.0 inside
http LAN-network 255.255.255.0 inside
http 10.0.0.0 255.255.255.0 Management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
vpdn username ============= password ============= store-local
dhcpd auto_config outside
!

threat-detection basic-threat
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect esmtp 
  inspect sqlnet 
  inspect skinny  
  inspect sunrpc 
  inspect xdmcp 
  inspect sip  
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
prompt hostname context 
Cryptochecksum:=============
: end
asdm location LAN-network 255.255.255.0 inside
asdm location WIRELESS-network 255.255.255.0 inside
asdm location RANDD-network 255.255.255.0 inside
asdm location CNC-network 255.255.255.0 inside
asdm location LEGACY-network 255.255.255.0 inside
asdm location InternalGateway 255.255.255.255 inside
asdm location DCServer 255.255.255.255 inside
asdm location MUVS-TP 255.255.255.255 inside
no asdm history enable

PS: I wasn't sure if this was a better fit here or on SF. I have no problem with it being moved.

  • 1
    Is the mask on the outside interface really 255.0.0.0? What did the ISP assign you? – Brett Lykins Mar 7 '14 at 0:14
  • @BrettLykins The ISP technician came out yesterday and set up the router, it was pre-configured with 125.x.x.9. When she tested it and showed me it was working for me to signoff she did so by connecting her laptop to it and setting her IP to 125.x.x.10, her mask to 255.0.0.0 and her default gateway to 125.x.x.9. I have made the assumption those were the correct values based on her using them. Is it unlikely for a public IP to have such a wide network? – Chris O'Kelly Mar 7 '14 at 0:22
  • 1
    Ok, so odds are that the subnetmask should be 255.255.255.252 (a /30). That is the usual size of an interface assignment and would make sense based on the .9 and .10 addresses. Back to your question, yes you would need a route and also a NAT configuration. Can you post the entire configuration of the ASA? Obviously sanitized of passwords etc. – Brett Lykins Mar 7 '14 at 0:38
  • I've just discovered how to do that in GUI. Will do now (it's file>show running config in new window, right?) – Chris O'Kelly Mar 7 '14 at 0:56
  • 1
    The technician did that because it was simple to configure for a simple test. She/you wouldn't do that IRL. – Ron Trunk Mar 7 '14 at 1:22
7

OK, after looking at your configuration, you are missing one statement:

route outside 0.0.0.0 0.0.0.0 125.x.x.9

This tells the firewall to forward all Internet traffic to the ISP's router at 125.x.x.9

  • Ron & @BrettLykins, you're both absolute legends. Posting this through my newly configured connection. You've already basically done my job for me, so I feel terrible asking, but do you mind explaining the role of the 0.0.0.0 address and mask there? Is it just "all addresses on all networks" essentially? – Chris O'Kelly Mar 7 '14 at 1:40
  • Also - on other sites I would normally wait a day to mark an answer so as not to deter other, possibly helpful to others, answers. As this is just a "I missed a glaring misconfig and this is the single answer", should I just mark you now? – Chris O'Kelly Mar 7 '14 at 1:43
  • If you want to mark it as correct, I won't object ;-p The statement is called a "default route." It instructs the firewall to forward any traffic that does not belong to any of the local subnets to the ISP router. The 0.0.0.0 0.0.0.0 part means "match any network." There's a more technical explanation, but it won't fit in the comments section. – Ron Trunk Mar 7 '14 at 1:56
  • I probably wouldn't grasp the more technical one anyway heh. Thanks again! – Chris O'Kelly Mar 7 '14 at 2:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.