Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Just configuring a Cisco ASA 5505. I thought I had it set up correctly, but there is obviously something wrong.

Hosts on the inside vlan cannot access anything outside. Inside hosts can ping and SSH to the inside interface on the ASA. The ASA can ping hosts inside and outside. The ASA can be pinged from outside.

Running config below. The name, access-list, static, global, nat & route lines came from a working PIX which is being replaced.

I know there are lots of people asking similar questions and I've read through quite a lot of them but I can't see what I've got wrong. Apologies for all the XXXX everywhere, I just don't really want Google indexing anything sensitive!

I'd be grateful if anyone can spot my obvious mistake! Thanks. :)

: Saved
:
ASA Version 7.2(3) 
!
hostname XXXX
domain-name XXXX
enable password XXXX encrypted
names
name X.X.X.61 bb-office
name X.X.X.128 gl-office
name 10.0.0.117 dialler_in
name X.X.X.117 dialler_out
name 10.0.0.112 data-2_in
name X.X.X.112 data-2_out
name 10.0.0.81 corp-1_in
name X.X.X.81 corp-1_out
name 10.0.0.111 data-1_in
name X.X.X.210 user_75
!
interface Vlan1
 nameif inside
 security-level 100
 ip address 10.0.0.1 255.255.255.0 
!
interface Vlan2
 nameif outside
 security-level 0
 ip address X.X.X.70 255.255.255.252 
!
interface Vlan3
 shutdown
 no forward interface Vlan1
 nameif dmz
 security-level 50
 no ip address
!
interface Ethernet0/0
 switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
passwd XXXX encrypted
ftp mode passive
dns server-group DefaultDNS
 domain-name XXXX
same-security-traffic permit inter-interface
access-list Cisco_splitTunnelAcl standard permit any 
access-list inbound extended permit tcp host bb-office host dialler_out eq 5900 
access-list inbound extended permit tcp host bb-office host dialler_out eq 4040 
access-list inbound extended permit tcp host bb-office host dialler_out eq 9876 
access-list inbound extended permit tcp host bb-office host dialler_out eq sip 
access-list inbound extended permit tcp host bb-office host dialler_out eq www 
access-list inbound extended permit tcp host bb-office host dialler_out eq https 
access-list inbound extended permit udp host bb-office host dialler_out eq sip 
access-list inbound extended permit tcp host bb-office host dialler_out eq 1433 
access-list inbound extended permit udp host bb-office host dialler_out eq netbios-ns 
access-list inbound extended permit udp host bb-office host dialler_out eq netbios-dgm 
access-list inbound extended permit tcp host bb-office host dialler_out eq netbios-ssn 
access-list inbound extended permit tcp host bb-office host dialler_out eq 445 
access-list inbound extended permit tcp host gl-office host dialler_out eq 4040 
access-list inbound extended permit tcp host gl-office host dialler_out eq 9876 
access-list inbound extended permit tcp host gl-office host dialler_out eq sip 
access-list inbound extended permit tcp host gl-office host dialler_out eq www 
access-list inbound extended permit tcp host gl-office host dialler_out eq https 
access-list inbound extended permit udp host gl-office host dialler_out eq sip 
access-list inbound extended permit tcp host gl-office host dialler_out eq 1433 
access-list inbound extended permit udp host gl-office host dialler_out eq netbios-ns 
access-list inbound extended permit udp host gl-office host dialler_out eq netbios-dgm 
access-list inbound extended permit tcp host gl-office host dialler_out eq netbios-ssn 
access-list inbound extended permit tcp host gl-office host dialler_out eq 445 
access-list inbound extended permit tcp host gl-office host dialler_out eq 5900 
access-list inbound extended permit tcp any host data-2_out eq ssh 
access-list inbound extended permit tcp any host corp-1_out eq ssh 
access-list inbound extended permit tcp any host corp-1_out eq www 
access-list inbound extended permit tcp any host corp-1_out eq pop3 
access-list inbound extended permit tcp any host corp-1_out eq imap4 
access-list inbound extended permit tcp any host corp-1_out eq smtp 
access-list inbound extended permit tcp any host corp-1_out eq 995 
access-list inbound extended permit tcp any host corp-1_out eq 465 
access-list inbound extended permit tcp any host corp-1_out eq 993 
access-list inbound extended permit tcp any host corp-1_out eq 8008 
access-list inbound extended permit udp X.X.X.64 255.255.255.192 host X.X.X.113 eq netbios-ns 
access-list inbound extended permit udp X.X.X.64 255.255.255.192 host X.X.X.113 eq netbios-dgm 
access-list inbound extended permit tcp X.X.X.64 255.255.255.192 host X.X.X.113 eq netbios-ssn 
access-list inbound extended permit tcp X.X.X.64 255.255.255.192 host X.X.X.113 eq 445 
access-list inbound extended permit udp any host X.X.X.113 eq netbios-ns 
access-list inbound extended permit udp any host X.X.X.113 eq netbios-dgm 
access-list inbound extended permit tcp any host X.X.X.113 eq netbios-ssn 
access-list inbound extended permit tcp any host X.X.X.113 eq 445 
access-list inbound extended permit tcp host bb-office host data-2_out eq 5901 
access-list inbound extended permit tcp host bb-office host data-2_out eq 3690 
access-list inbound extended permit tcp host bb-office host data-2_out eq www 
access-list inbound extended permit tcp host bb-office host dialler_out eq 3389 
access-list inbound extended permit tcp host X.X.X.18 host data-2_out eq 3306 
access-list inbound extended permit tcp any host data-2_out eq 3306 
access-list inbound extended permit tcp host X.X.X.7 host dialler_out eq 5900 
access-list inbound extended permit tcp host bb-office host data-2_out eq 3306 
access-list inbound extended permit tcp host user_75 host dialler_out eq 1433 
access-list inbound extended permit tcp host user_75 host dialler_out eq 5900 
access-list inbound extended permit tcp host user_75 host data-2_out eq 3690 
access-list inbound extended permit tcp host user_75 host data-2_out eq www 
access-list inbound extended permit tcp host user_75 host data-2_out eq 3306 
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-523.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) dialler_out dialler_in netmask 255.255.255.255 
static (inside,outside) corp-1_out corp-1_in netmask 255.255.255.255 
static (inside,outside) data-2_out data-2_in netmask 255.255.255.255 
static (inside,outside) X.X.X.113 data-1_in netmask 255.255.255.255 
access-group inbound in interface outside
route outside 0.0.0.0 0.0.0.0 78.40.147.69 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
aaa authentication ssh console LOCAL 
aaa authorization command LOCAL 
http server enable
http 10.0.0.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 0.0.0.0 0.0.0.0 inside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 5
console timeout 0
dhcpd dns X.X.X.91 8.8.8.8
dhcpd auto_config outside
!
dhcpd address 10.0.0.20-10.0.0.40 inside
!

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum 4096
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect rsh 
  inspect rtsp 
  inspect sqlnet 
  inspect skinny 
  inspect sunrpc 
  inspect xdmcp 
  inspect sip 
  inspect netbios 
  inspect tftp 
!
service-policy global_policy global
username cisco password GNlpGXutmjL9QI0T encrypted
username matt password 6adrQ37riduXXEdZ encrypted
privilege cmd level 3 mode exec command perfmon
privilege cmd level 3 mode exec command ping
privilege cmd level 3 mode exec command who
privilege cmd level 3 mode exec command logging
privilege cmd level 3 mode exec command failover
privilege show level 5 mode exec command running-config
privilege show level 3 mode exec command reload
privilege show level 3 mode exec command mode
privilege show level 3 mode exec command firewall
privilege show level 3 mode exec command interface
privilege show level 3 mode exec command clock
privilege show level 3 mode exec command dns-hosts
privilege show level 3 mode exec command access-list
privilege show level 3 mode exec command logging
privilege show level 3 mode exec command ip
privilege show level 3 mode exec command failover
privilege show level 3 mode exec command asdm
privilege show level 3 mode exec command arp
privilege show level 3 mode exec command route
privilege show level 3 mode exec command ospf
privilege show level 3 mode exec command aaa-server
privilege show level 3 mode exec command aaa
privilege show level 3 mode exec command crypto
privilege show level 3 mode exec command vpn-sessiondb
privilege show level 3 mode exec command ssh
privilege show level 3 mode exec command dhcpd
privilege show level 3 mode exec command vpn
privilege show level 3 mode exec command blocks
privilege show level 3 mode exec command uauth
privilege show level 3 mode configure command interface
privilege show level 3 mode configure command clock
privilege show level 3 mode configure command access-list
privilege show level 3 mode configure command logging
privilege show level 3 mode configure command ip
privilege show level 3 mode configure command failover
privilege show level 5 mode configure command asdm
privilege show level 3 mode configure command arp
privilege show level 3 mode configure command route
privilege show level 3 mode configure command aaa-server
privilege show level 3 mode configure command aaa
privilege show level 3 mode configure command crypto
privilege show level 3 mode configure command ssh
privilege show level 3 mode configure command dhcpd
privilege show level 5 mode configure command privilege
privilege clear level 3 mode exec command dns-hosts
privilege clear level 3 mode exec command logging
privilege clear level 3 mode exec command arp
privilege clear level 3 mode exec command aaa-server
privilege clear level 3 mode exec command crypto
privilege cmd level 3 mode configure command failover
privilege clear level 3 mode configure command logging
privilege clear level 3 mode configure command arp
privilege clear level 3 mode configure command crypto
privilege clear level 3 mode configure command aaa-server
prompt hostname context 
Cryptochecksum:d92792c427d11322e1fc2d90b6afbf17
: end
share|improve this question
    
That's a very old ASA software version. Either way, have you tried using the Cisco ASDM graphical interface? Maybe I'm weird, but I make good use of it during the initial config of ASA devices. –  ewwhite Feb 3 '13 at 21:48
    
Yeah, might be, but it should work all the same. Not sure if I have access to any later versions though - I don't have a support contract and I'm not certified. I used to use the GUI but these days I struggle to get it to load up - it doesn't play well with current browsers. People always used to tell me to use the command line so these days I always do. –  Matt Ralston Feb 3 '13 at 21:55
    
should this line global (outside) 1 interface be global (outside) 1 interface vlan 2 –  Steve Feb 3 '13 at 22:13
    
Hi Steve. Thanks for the suggestion. You might be onto something I'm not sure, but it won't allow the config change exactly as you've specified. It does the usual "Invalid input detected at" and points at the word vlan. I tried a few similar variations and looked did a bit of Googling of the global command but I haven't been able to crack it yet. –  Matt Ralston Feb 4 '13 at 23:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.