I'll start by pointig out that networking issues have always left me scratching my head. There is something about routing especially that I just haven't had that "Oh I get it" moment yet, so it's likely this is a very basic misconfiguration.
I am trying to set up a Cisco ASA 5505 to be connected with a public IP address on one interface, and to have the second interface connect to our internal network. Right now our internal network is on 192.168.1.0/24, and the public IP we have from the ISP is in the 125.x.x.x range.
I have set up 3 interfaces on the ASA,
IP: 192.168.1.3 Mask: 255.255.255.0 Ports 1-6 Sec Level 100
IP: 125.x.x.x Mask: 255.0.0.0 Port 0 Sec Level 0
IP: 10.0.0.1 Mask: 255.255.255.0 Port 7 Restricted to management Restrict flow to Outside (had to do this for licensing reasons)
I have an access rule on the firewall that allows IP traffic from any source on the inside network to any less secure network (there is one for both IPv4 and 6).
With the internet-facing router connected to port 0, I connect a computer to port 1 with IP
255.255.255.0 and gateway
192.168.1.3. Using this PC I can ping
192.168.1.3 but no further - I cannot ping the public IP address or
If I connect the same PC directly to the router and assign it the public IP address directly I can access the internet no problem. I believe that the issue here is that I need to add some static routes to show the path from inside<->outside, but I just do not grok them well enough to know how to structure them. Any help or suggestions would be very much appreciated.
Edit: See below the running config, with some redactions.
: Saved : ASA Version 8.2(1) ! hostname AUS-FW-01 domain-name =============.com.au enable password ============= encrypted passwd ============= encrypted names name 10.61.76.0 CNC-network name 10.61.73.0 LAN-network name 192.168.1.0 LEGACY-network name 10.61.75.0 RANDD-network name 10.61.74.0 WIRELESS-network name 10.61.73.5 InternalGateway name 192.168.1.200 DCServer name 192.168.1.214 MUVS-TP description Trueform Print Server ! interface Vlan1 nameif inside security-level 100 ip address 192.168.1.3 255.255.255.0 ! interface Vlan2 nameif outside security-level 0 ip address 125.x.x.10 255.255.255.252 ! interface Vlan12 no forward interface Vlan2 nameif Management security-level 0 ip address 10.0.0.1 255.255.255.0 management-only ! interface Ethernet0/0 switchport access vlan 2 ! interface Ethernet0/1 ! interface Ethernet0/2 ! interface Ethernet0/3 ! interface Ethernet0/4 ! interface Ethernet0/5 ! interface Ethernet0/6 ! interface Ethernet0/7 switchport access vlan 12 ! ftp mode passive clock timezone EST 10 dns domain-lookup outside dns server-group DefaultDNS name-server ============= name-server ============= domain-name =============.com.au same-security-traffic permit intra-interface access-list outside_access_in remark Email access access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq smtp access-list outside_access_in remark ActiveSync Email Access access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq https access-list outside_access_in remark Pronto Trueform Printing access-list outside_access_in extended permit tcp any LEGACY-network 255.255.255.0 eq lpd pager lines 24 logging asdm informational mtu inside 1500 mtu outside 1500 mtu Management 1500 icmp unreachable rate-limit 1 burst-size 1 no asdm history enable arp timeout 14400 global (outside) 1 interface nat (inside) 1 0.0.0.0 0.0.0.0 static (inside,outside) tcp interface smtp DCServer smtp netmask 255.255.255.255 static (inside,outside) tcp interface https DCServer https netmask 255.255.255.255 static (inside,outside) tcp interface lpd MUVS-TP lpd netmask 255.255.255.255 access-group outside_access_in in interface outside route inside LAN-network 255.255.255.0 10.61.79.2 1 route inside LEGACY-network 255.255.255.0 InternalGateway 1 timeout xlate 3:00:00 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 dynamic-access-policy-record DfltAccessPolicy http server enable http 10.61.79.0 255.255.255.0 inside http LAN-network 255.255.255.0 inside http 10.0.0.0 255.255.255.0 Management no snmp-server location no snmp-server contact snmp-server enable traps snmp authentication linkup linkdown coldstart crypto ipsec security-association lifetime seconds 28800 crypto ipsec security-association lifetime kilobytes 4608000 telnet timeout 5 ssh timeout 5 console timeout 0 vpdn username ============= password ============= store-local dhcpd auto_config outside ! threat-detection basic-threat threat-detection statistics port threat-detection statistics protocol threat-detection statistics access-list no threat-detection statistics tcp-intercept webvpn ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum 512 policy-map global_policy class inspection_default inspect dns preset_dns_map inspect ftp inspect h323 h225 inspect h323 ras inspect rsh inspect rtsp inspect esmtp inspect sqlnet inspect skinny inspect sunrpc inspect xdmcp inspect sip inspect netbios inspect tftp ! service-policy global_policy global prompt hostname context Cryptochecksum:============= : end asdm location LAN-network 255.255.255.0 inside asdm location WIRELESS-network 255.255.255.0 inside asdm location RANDD-network 255.255.255.0 inside asdm location CNC-network 255.255.255.0 inside asdm location LEGACY-network 255.255.255.0 inside asdm location InternalGateway 255.255.255.255 inside asdm location DCServer 255.255.255.255 inside asdm location MUVS-TP 255.255.255.255 inside no asdm history enable
PS: I wasn't sure if this was a better fit here or on SF. I have no problem with it being moved.