Hot Downloads

Welcome, Guest
Username: Password: Remember me

TOPIC: problems with a Cisco ASA 5505

problems with a Cisco ASA 5505 6 years 9 months ago #33889

  • gilgamezh
  • gilgamezh's Avatar
  • Offline
  • New Member
  • Posts: 1
  • Karma: 0
I am having some problems with a Cisco ASA 5505 Firewall.
apparently the settings are correct, but from the INSIDE network can not ping a public IP.
Perhaps I am missing something that can not see

The WAN connection is connected on port 0 / 1
Lan on 0/0

This is my configuration:

# show running-config
: Saved
:
ASA Version 8.2(1)
!
XXXXXXXXX

names
!
interface Vlan1
nameif inside
security-level 100
ip address 172.20.10.254 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address 190.XXX.XXX.134 255.255.255.248
!
interface Ethernet0/0
!
interface Ethernet0/1
switchport access vlan 2
!
interface Ethernet0/2
shutdown
!
interface Ethernet0/3
shutdown
!
interface Ethernet0/4
shutdown
!
interface Ethernet0/5
shutdown
!
interface Ethernet0/6
shutdown
!
interface Ethernet0/7
shutdown
!
ftp mode passive
access-list salida extended permit ip any any
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 172.20.10.0 255.255.255.0
access-group salida in interface inside
route outside 0.0.0.0 0.0.0.0 190.XXX.XXX.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context




Thank you very much for your help!

PS: excuse my language.
The administrator has disabled public write access.

Re: problems with a Cisco ASA 5505 6 years 9 months ago #33892

  • krik
  • krik's Avatar
  • Offline
  • Frequent Member
  • Posts: 69
  • Karma: 0
Hi,

Config seems ok for me...

Could you try to change your global command as follow :

global (outside) 1 190.XXX.XXX.134

Could you also do a "shwo nat" and "show xlate" after you try to reach an external IP?
Christophe Lemaire
www.exp-networks.be/blog/
The administrator has disabled public write access.

Re: problems with a Cisco ASA 5505 6 years 8 months ago #33921

  • S0lo
  • S0lo's Avatar
  • Offline
  • Moderator
  • Posts: 1577
  • Thank you received: 7
  • Karma: 3
After a quick peek, I also don't see any thing clearly wrong. Try removing those two commands:

access-list salida extended permit ip any any
access-group salida in interface inside

You don't need an ACL to let traffic flow from high to low security interfaces. Unless you plan this for some thing else.

I assume you also tried clear xlate command. Can you ping 190.XXX.XXX.134 and 190.XXX.XXX.129 ?

When you ping an outside IP, what message does it give you? is it a Request timed out. or Destination Host Unreachable.
Studying CCNP...

Ammar Muqaddas
Forum Moderator
www.firewall.cx
The administrator has disabled public write access.

Re: problems with a Cisco ASA 5505 5 years 10 months ago #36133

  • sethshawn
  • sethshawn's Avatar
  • Offline
  • New Member
  • Posts: 1
  • Karma: 0
Hi,

Config seems ok for me...

Could you try to change your global command as follow :

global (outside) 1 190.XXX.XXX.134

Could you also do a "shwo nat" and "show xlate" after you try to reach an external IP?
It may be worked in my case thanks
Shawn Rocks
The administrator has disabled public write access.

Re: problems with a Cisco ASA 5505 5 years 7 months ago #36731

  • kiki80
  • kiki80's Avatar
  • Offline
  • New Member
  • Posts: 2
  • Karma: 0
Hello , I have problem with my ASA 5505 .
When I upgrade IOS , I made mistake and deleted flash .... after that I booted from tftp server and get up IOS an disk0: . "Everything" is OK , the router working ....., but when need reboot of ASA 5505 , my router does not boot from disk0:asaXXX.bin and load ROMMON# and I have to set it to boot from tftp Sad .
I followed the commands :

asa5505#boot system disk0:asaXXX.bin
asa5505#reload
.....
after restart

asa5505#sh ver
Cisco Adaptive Security Appliance Software Version 8.2(2)
Device Manager Version 6.2(5)

Compiled on Mon 11-Jan-10 14:19 by builders
System image file is "tftp://192.168.1.1/asa822-k8.bin"
Config file at boot was "startup-config"

ASA5505 up 16 hours 21 mins

Hardware: ASA5505, 512 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash M50FW080 @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CN1000-MC-BOOT-2.00
SSL/IKE microcode: CNLite-MC-SSLm-PLUS-2.03
IPSec microcode : CNlite-MC-IPSECm-MAIN-2.04
.......

and every time the router wants to boot from tftp: , that is absurdity Sad .

Do you have any ideas how I repair this problem please ??? Sad
The administrator has disabled public write access.

Re: problems with a Cisco ASA 5505 5 years 7 months ago #36735

  • S0lo
  • S0lo's Avatar
  • Offline
  • Moderator
  • Posts: 1577
  • Thank you received: 7
  • Karma: 3
kiki80, maybe you forgot to set the configuration register to it's default value of 0x1. You can do it like this:

[code:1]config-register 0x1[/code:1]

Or you can do it from ROMMON like this:

[code:1]confreg 0x1[/code:1]
Studying CCNP...

Ammar Muqaddas
Forum Moderator
www.firewall.cx
The administrator has disabled public write access.
Time to create page: 0.091 seconds

CCENT/CCNA

Cisco Routers

  • SSL WebVPN
  • Securing Routers
  • Policy Based Routing
  • Router on-a-Stick

VPN Security

  • Understand DMVPN
  • GRE/IPSec Configuration
  • Site-to-Site IPSec VPN
  • IPSec Modes

Cisco Help

  • VPN Client Windows 8
  • VPN Client Windows 7
  • CCP Display Problem
  • Cisco Support App.

Windows 2012

  • New Features
  • Licensing
  • Hyper-V / VDI
  • Install Hyper-V

Linux

  • File Permissions
  • Webmin
  • Groups - Users
  • Samba Setup