Cisco ASA 5505 – Troubleshooting Configuration Issues

ciscocisco-asafirewall

I have been at this for 2 days, been through countless forums and tutorials as far as configuring my ASA-5505. I can't get out to the internet (even using ping from the ASA), I can't "see" the ASA on the network .. Basically it's a dead piece of hardware other than the Console. My modem has been set to bridged mode as well. This is the tutorial I followed: HERE.. Not sure where to go next .. The "outside" vlan seems to be misconfigured, and I've tried so many permeations, that I am sure I am overlooking something major, and obvious. When I am able to ping 8.8.8.8, from the ASA, I'll be happy!

Here are my Comcast settings:

Gateway MAC Address           78:CD:8E:D9:FB:34
WAN MAC Address               78:CD:8E:D9:FB:37
WAN DHCP IP Address           50.135.170.116
WAN DHCP IPv6 Address         ::/64
WAN DHCP IPv6 DNS (primary)   ::
WAN DHCP IPv6 DNS (secondary) ::
WAN DHCP Subnet Mask          255.255.254.0
WAN DHCP Default Gateway      50.xx.xx.1
WAN Internet IP Address       74.xx.xx.230
DNS (primary)                 75.75.75.75
DNS (secondary)               75.75.76.76
DHCP Time Remaining           92h:42m:22s
Internal Gateway IP Address   10.1.10.1
Internal Subnet Mask          255.255.255.0
INTERNAL DHCP                 DISABLED

Here is my ASA configuration:

ASA Version 8.2(5)
!
hostname DTS-ASA
enable password xxxxxxxxxxxxxx encrypted
passwd xxxxxxxxxxx encrypted
names
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
 shutdown
!
interface Ethernet0/3
 shutdown
!
interface Ethernet0/4
 shutdown
!
interface Ethernet0/5
 shutdown
!
interface Ethernet0/6
 shutdown
!
interface Ethernet0/7
 shutdown
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.1.10.100 255.255.255.0
!
interface Vlan2
 nameif outside
 security-level 0
 ip address 74.xx.xx.230 255.255.255.248
!
ftp mode passive
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10 10.1.10.0 255.255.255.0
route outside 0.0.0.0 0.0.0.0 74.xx.xx.230 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
username cisco password ZBZ8GNEdrJsjFvsR encrypted privilege 15
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect ip-options
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
 service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:86f051cb52af3d343c52cf1a222c6901
: end

Link I said, I am probably missing something critical and obvious, however having a development background networking is a somewhat foreign concept.

Best Answer

The "outside" vlan seems to be misconfigured, and I've tried so many permeations, that I am sure I am overlooking something major, and obvious. When I am able to ping 8.8.8.8, from the ASA, I'll be happy!

Basic Config

As others have mentioned, your configuration is "suboptimal"... the biggest problem you have is that you're not using DHCP on the outside Vlan interface the biggest problem is that your default gw address is assigned to Vlan2... to recover, login to the console and...

  • copy runn flash:foobar.cfg
  • config t
  • configure factory-default 10.1.10.100 255.255.255.0

While you're in config mode, use this configuration...

hostname DTS-ASA
password ChangeMeNow
enable password ChangeMeNow
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Vlan2
 ! I don't think you need this, since it's an SMC MAC addr
 ! However, this illustrates how you can manually change the mac
 ! on your outside Vlan, if Comcast is restricting you
 ! to one mac (and now refuses to change it)
 ! mac-address 78cd.8ed9.fb37
 nameif outside
 security-level 0
 ip address 74.xx.xx.225 255.255.255.248
!
route outside 0.0.0.0 0.0.0.0 74.xx.xx.230
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
end
wr mem

Please change the password :-)... now you need fw rules, but that's a different issue

WAN Validation

Make sure you really do have the Comcast modem attached to Eth0/0... After you're up and running, you should be able to check the address you got from Comcast like this...

DTS-ASA# sh int vlan2
Interface Vlan2 "outside", is up, line protocol is up
  Hardware is EtherSVI, BW 100 Mbps, DLY 100 usec
        MAC address 0030.dead.beef, MTU 1500
        IP address 74.xx.xx.225, subnet mask 255.255.255.248     <------------
  Traffic Statistics for "outside":
        108703406 packets input, 119199091796 bytes
        69134254 packets output, 8083775282 bytes
        1654709 packets dropped
      1 minute input rate 2 pkts/sec,  280 bytes/sec
      1 minute output rate 3 pkts/sec,  414 bytes/sec
      1 minute drop rate, 0 pkts/sec
      5 minute input rate 3 pkts/sec,  716 bytes/sec
      5 minute output rate 4 pkts/sec,  520 bytes/sec
      5 minute drop rate, 0 pkts/sec
DTS-ASA#

Then check your ping to google's DNS...

DTS-ASA# ping 8.8.8.8
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 10/18/20 ms
DTS-ASA#

If not, be sure you can ping your default-gw...

DTS-ASA# sh route

Codes: C - connected, S - static, I - IGRP, R - RIP, M - mobile, B - BGP
       D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
       E1 - OSPF external type 1, E2 - OSPF external type 2, E - EGP
       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area
       * - candidate default, U - per-user static route, o - ODR
       P - periodic downloaded static route

Gateway of last resort is 74.xx.xx.230 to network 0.0.0.0

C    74.xx.xx.230 255.255.255.248 is directly connected, outside
C    10.1.10.0 255.255.255.0 is directly connected, inside
d*   0.0.0.0 0.0.0.0 [1/0] via 74.xx.xx.230, outside          <------
DTS-ASA#
DTS-ASA# ping 74.xx.xx.230
Related Topic