ASA Problem: Users have connectivity but can't load http

[James Bond]

I apologize in advance for the length. For future reference, I have replaced the real external IP with ?X.X.X.X?. Also, the IP of the server I mention is 10.0.0.17.

I just finished hooking up my first ASA ? I had already configured it ahead of time.

Beforehand, it had been my understanding that only two interfaces would be necessary: inside and outside. When I got on-site, it was immediately apparent that they had previously been using a DMZ for their one server. The license on this ASA only allowed 2 nameif?s, so I plugged the server into the third port on the ASA (E0/2) and added it to the same VLAN as my main inside interface (E0/1). The outside interface was on E0/0.

Right off the bat, I have a few questions.

The setup goes DSLModem -> ASA -> Switch -> Users. When I checked my routing table it showed a route to my internal network, so I figured that a static route internally wasn?t necessary. What confused me, though, was that the route looked something like this:

route to 10.0.0.0/24, connected, via ?inside?

Does this mean that all traffic heading towards the inbound hosts will also be sent to the server since they share the same VLAN?

Additionally, do I need a static route for the server, even though it is directly connected? If so, would it just be: route inside 10.0.0.17 255.255.255.255 10.0.0.17?

Immediately after hooking it up, I noticed a few things:

Inside hosts can ping the server(which is on its own interface, like I mentioned before)
Inside can ping ASA
Inside can ping External Gateway (last ISP hop), so I?m assuming it had full connectivity, although I couldn?t test any other IP?s since I didn?t have any memorized.

Server can ping inside hosts
Server can ping ASA
Server can *not* ping External Gateway.

My natural reaction was that it had to either be a NAT issue or ACL issue. Since the inside access-list is applied to the VLAN that both the server and inside network are members of, I ruled that out. At the time, I had only a couple NAT statements:

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
static (inside,outside) X.X.X.X 10.0.0.17 netmask 255.255.255.255

It occurred to me that I didn?t need a static route for the server, since all connections would be made through the VPN. I deleted the route, and was then able to ping the External Gateway from the Server. Why?

At this point, I attempted to get online with both the server and hosts on the internal network, but wasn't able to load any web pages. I knew that DNS had to be the natural culprit. Throughout my configuration, I had the following DNS statements:

dns domain-lookup inside
dns domain-lookup outside
dns server-group DefaultDNS
domain-name default.domain.invalid
name-server first.isp.dns.server
name-server second.isp.dns.server
group-policy DfltGrpPolicy attributes
dns-server value 10.0.0.17
group-policy VPN_GRP_POLICY
dns-server value 10.0.0.17

When I checked ?ipconfig? on the host pc?s, it showed 10.0.0.17 as the DNS server, as it should. When I entered the DNS IP manually in Windows TCP/IP config (I?m referring to the ISP?s DNS server), all web pages work. I played around with the DNS commands some and the behavior was odd ? it seemed to load pages, but very slowly (when DHCP is handling DNS). After a while, all pages loaded fine and at full speed. I re-entered the old static NAT statement for kicks, and it killed my connection completely. I removed it from the config, and observed the original behavior of slow loading pages. It again sped up after about 15 minutes for seemingly no reason.

I left it after a while and pages seemed to be working properly. Still though, something doesn't seem right. Also, I'm not able to ping or connect to the ASA remotely, even though I'm positive it's accepting ICMP, and should also be accepting VPN connections.

Any advice would be MUCH appreciated.

Thanks

 

[nightowl]

Ok, that is a lot of text and I really do not feel like reading through all of it and trying to discern what is going on (I have skimmed most of it though).

So, if you could quickly summarize what you are trying to do and what is not working that would be helpful. I initially thought you had a NAT problem because your statement looks to be incorrect. However, I am not so sure what exactly you are trying to do. Also, at the end you are talking about VPN and I am not sure where that fits in.

One thing to remember, is that unless you permit ICMP, it is not going to pass through fully when you are a L3 hop away.

 

[fintheman]

DSL Modem = Problem

I avoid using DSL like the plague because the companies usually send these pieces of shit modems (Westel). Check to see the settings inside of the DSL modem itself and see if there is an ip passthrough.

 

[nightowl]

Originally posted by: fintheman
DSL Modem = Problem

I avoid using DSL like the plague because the companies usually send these pieces of shit modems (Westel). Check to see the settings inside of the DSL modem itself and see if there is an ip passthrough.

That does not seem to have anything to do with the problem at hand. The OP has a public IP on the outside already. Also, to make a blanket statement like that is based on your experience and not the norm for everyone else.

 

[James Bond]

Sorry to be so unclear before, I was sorta rushing

My main two problems were this:
1.
At first, after hooking everything up, internal hosts (on port e0/1) were able to ping the external gateway (ie: full layer 3 access to the internet). Oddly enough, the server (port e0/2, same vlan as port e0/1 though), could only ping as far as the internal interface on the ASA. Once I removed the Static NAT statement, this problem was resolved. I still don't understand why I was having that problem though... Isn't my statement correct?

2.
I was having major DNS issues (I think). I would be able to ping outside, but not go to any web pages. After waiting for a few minutes (and renewing IP's, etc) I would suddenly be able to access web pages, but *extremely slowly*. It seemed that if I waited for a while (10+ minutes), I would be able to access pages at full speed and with no difficulty. I reapplied my Static NAT statement for kicks, and was again not able to get to web pages. After taking the statement out, the same pattern occurred: no access, slow access, then normal speed.

I'm still not sure what the problem was, but it seems to be working okay now.

Any thoughts?

 

[funkbass81]

whats your default route set as?

 

[James Bond]

route outside 0.0.0.0 0.0.0.0 <EXT.IP> 1

 

[nightowl]

First, do you have just one address? If so, is it static? Also, for your default route, where you have <EXT IP>, is that the external IP or the first hop? It should be your first hop.

Finally, can you post the nat/global and static statements you have right now? The DNS configuration that you have on the ASA has no effect on the clients as it is for the ASA OS to do DNS.

 

[hiromizu]

Also are you using the Cisco GUI software or via CLI? I find that the GUI tends to screw things up.

 

[James Bond]

I think the problem was due to me not clearing the xlate after I was making changes. Since I installed it has been working fine.

It uses a static address, and I was using the first hop, so not my actual external IP.

I was using the CLI.

nat (inside) 1 0.0.0.0 0.0.0.0
global (outside) 1 interface

Only the 2 statements