Solved

Cisco ASA 5200 - Subinterfaces with VLAN's.  Problem getting VLANS to communicate with one another.

Posted on 2006-11-27
4
1,170 Views
Last Modified: 2008-02-01
Folks,

   I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another.  The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data.  I'd like VLAN 20 to be able to NAT outside and have this functioning.  VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN.  VLAN 10 and 20 need to be able to communicate.

   The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.  

   Config pasted below.  Help appreciated.

sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
 description Test
 nameif inside
 security-level 100
 no ip address
!
interface GigabitEthernet0/1.10
 description Disk Array Interface
 vlan 10
 nameif DiskArray
 security-level 100
 ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
 description VMware Server interface
 vlan 20
 nameif VMServers
 security-level 100
 ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 10.100.101.254 255.255.255.0
 management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101.150 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc59c05224041c45df58e7cb
: end


TIA!
0
Comment
Question by:winningtech
  • 3
4 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 500 total points
ID: 18027433
Have you tried this?

access-list nonat permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list nonat permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0


nat (inside) 0 access-list nonat

DC

0
 

Author Comment

by:winningtech
ID: 18027553
I'll give that a try, thanks!
0
 

Author Comment

by:winningtech
ID: 18028887
That didn't seem to work.  If anyone else has a thought I'd appreciate it!
0
 

Author Comment

by:winningtech
ID: 18033112
Actually, it was very close to the solution.  

What worked was:

access-list DiskArray_nat0_outbound extended permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list VMServers_nat0_outbound extended permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0

and

nat (DiskArray) 0 access-list DiskArray_nat0_outbound
nat (VMServers) 0 access-list VMServers_nat0_outbound

Will award points as it put me onto the right track.

Thanks!
0

Featured Post

Network it in WD Red

There's an industry-leading WD Red drive for every compatible NAS system to help fulfill your data storage needs. With drives up to 8TB, WD Red offers a wide array of solutions for customers looking to build the biggest, best-performing NAS storage solution.  

Join & Write a Comment

Imagine you have a shopping list of items you need to get at the grocery store. You have two options: A. Take one trip to the grocery store and get everything you need for the week, or B. Take multiple trips, buying an item at a time, to achieve t…
Hi All,  Recently I have installed and configured a Sonicwall NS220 in the network as a firewall and Internet access gateway. All was working fine until users started reporting that they cannot use the Cisco VPN client to connect to the customer'…
Viewers will learn how to connect to a wireless network using the network security key. They will also learn how to access the IP address and DNS server for connections that must be done manually. After setting up a router, find the network security…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now