Cisco ASA5505 Setup

[grantfeldman]

hi guys, im having a bit of a rough time with my cisco asa 5505 firewall router. this is my first time i have had to set one up and im having major trouble getting any sort of connection from the inside to the outside. i could ramble on able what i have setup but i gather the running config should tell you what you need to know?

thanks in advance
grant



Result of the command: "sh run"

: Saved
:
ASA Version 8.2(5)
!
hostname ciscoasa
enable password ujimlIg08LEZjnzF encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
interface Vlan1
nameif inside
security-level 100
ip address 80.0.0.1 255.0.0.0
!
interface Vlan2
nameif outside
security-level 0
ip address dhcp setroute
!
ftp mode passive
clock timezone EST 10
clock summer-time EDT recurring last Sun Oct 2:00 last Sun Mar 3:00
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
ipv6 access-list internet_access_ipv6_in permit ip any any
ipv6 access-list protected_access_ipv6_in permit ip any any
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group protected_access_ipv6_in in interface inside
access-group internet_access_ipv6_in in interface outside
route inside 0.0.0.0 0.0.0.0 80.0.0.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 80.0.0.0 255.0.0.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd auto_config outside
!
dhcpd address 80.0.0.2-80.0.0.30 inside
dhcpd dns 8.8.8.8 8.8.4.4 interface inside
dhcpd auto_config outside interface inside
dhcpd enable inside
!

threat-detection basic-threat
threat-detection statistics access-list
threat-detection statistics tcp-intercept rate-interval 30 burst-rate 400 average-rate 200
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect esmtp
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect sip
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect xdmcp
inspect dns preset_dns_map
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:75a771a3f3ade4506bb8354343754592
: end

 

[grantfeldman]

sorry i forgot to post - when i look at the logs, i am see this repeated over and over again..

Deny inbound UDP from 80.0.0.2/59680 to 8.8.4.4/53 due to DNS Query
Deny inbound UDP from 80.0.0.2/59680 to 8.8.4.4/53 due to DNS Query
Deny inbound UDP from 80.0.0.2/59680 to 8.8.4.4/53 due to DNS Query
Deny inbound UDP from 80.0.0.2/59680 to 8.8.4.4/53 due to DNS Query
Deny inbound UDP from 80.0.0.2/59680 to 8.8.4.4/53 due to DNS Query

 

[iggsterman]

You need to remove one line:

route inside 0.0.0.0 0.0.0.0 80.0.0.1 1

The gateway of last resort is set by:
ip address dhcp setroute
As for the routing inside, your subnet is "connected" and does not need routing set up. If there are other subnets inside and are routed by another L3 device you can add specific routes for those. Or run OSPF on inside if you are so inclined.

What happened was your route statement confuses ASA and, among other things, makes DNS traffic to enter and exit the same interface, which is not allowed on ASA UNLESS it is configured to do so.

See if this fixes your problem.

 

[hairlessupportmonkey]

Just to let you know your Cisco Enable password is still default. change it now.

ACSS - SME
General Geek