[2 days left] What’s wrong with your cloud strategy? Learn why multicloud solutions matter with Nimble Storage.Register Now

x
?
Solved

Cisco ASA 5200 - Subinterfaces with VLAN's.  Problem getting VLANS to communicate with one another.

Posted on 2006-11-27
4
Medium Priority
?
1,239 Views
Last Modified: 2008-02-01
Folks,

   I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another.  The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data.  I'd like VLAN 20 to be able to NAT outside and have this functioning.  VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN.  VLAN 10 and 20 need to be able to communicate.

   The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.  

   Config pasted below.  Help appreciated.

sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
 description Test
 nameif inside
 security-level 100
 no ip address
!
interface GigabitEthernet0/1.10
 description Disk Array Interface
 vlan 10
 nameif DiskArray
 security-level 100
 ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
 description VMware Server interface
 vlan 20
 nameif VMServers
 security-level 100
 ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 10.100.101.254 255.255.255.0
 management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101.150 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc59c05224041c45df58e7cb
: end


TIA!
0
Comment
Question by:winningtech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 1500 total points
ID: 18027433
Have you tried this?

access-list nonat permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list nonat permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0


nat (inside) 0 access-list nonat

DC

0
 

Author Comment

by:winningtech
ID: 18027553
I'll give that a try, thanks!
0
 

Author Comment

by:winningtech
ID: 18028887
That didn't seem to work.  If anyone else has a thought I'd appreciate it!
0
 

Author Comment

by:winningtech
ID: 18033112
Actually, it was very close to the solution.  

What worked was:

access-list DiskArray_nat0_outbound extended permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list VMServers_nat0_outbound extended permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0

and

nat (DiskArray) 0 access-list DiskArray_nat0_outbound
nat (VMServers) 0 access-list VMServers_nat0_outbound

Will award points as it put me onto the right track.

Thanks!
0

Featured Post

Are You Ready for GDPR?

With the GDPR deadline set for May 25, 2018, many organizations are ill-prepared due to uncertainty about the criteria for compliance. According to a recent WatchGuard survey, a staggering 37% of respondents don't even know if their organization needs to comply with GDPR. Do you?

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will inform Clients about common and important expectations from the freelancers (Experts) who are looking at your Gig.
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
In this video we outline the Physical Segments view of NetCrunch network monitor. By following this brief how-to video, you will be able to learn how NetCrunch visualizes your network, how granular is the information collected, as well as where to f…
Suggested Courses

649 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question