?
Solved

Cisco ASA 5200 - Subinterfaces with VLAN's.  Problem getting VLANS to communicate with one another.

Posted on 2006-11-27
4
Medium Priority
?
1,229 Views
Last Modified: 2008-02-01
Folks,

   I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another.  The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data.  I'd like VLAN 20 to be able to NAT outside and have this functioning.  VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN.  VLAN 10 and 20 need to be able to communicate.

   The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.  

   Config pasted below.  Help appreciated.

sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
 description Test
 nameif inside
 security-level 100
 no ip address
!
interface GigabitEthernet0/1.10
 description Disk Array Interface
 vlan 10
 nameif DiskArray
 security-level 100
 ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
 description VMware Server interface
 vlan 20
 nameif VMServers
 security-level 100
 ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 10.100.101.254 255.255.255.0
 management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101.150 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc59c05224041c45df58e7cb
: end


TIA!
0
Comment
Question by:winningtech
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 3
4 Comments
 
LVL 1

Accepted Solution

by:
davidecooper1967 earned 1500 total points
ID: 18027433
Have you tried this?

access-list nonat permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list nonat permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0


nat (inside) 0 access-list nonat

DC

0
 

Author Comment

by:winningtech
ID: 18027553
I'll give that a try, thanks!
0
 

Author Comment

by:winningtech
ID: 18028887
That didn't seem to work.  If anyone else has a thought I'd appreciate it!
0
 

Author Comment

by:winningtech
ID: 18033112
Actually, it was very close to the solution.  

What worked was:

access-list DiskArray_nat0_outbound extended permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list VMServers_nat0_outbound extended permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0

and

nat (DiskArray) 0 access-list DiskArray_nat0_outbound
nat (VMServers) 0 access-list VMServers_nat0_outbound

Will award points as it put me onto the right track.

Thanks!
0

Featured Post

2017 Webroot Threat Report

MSPs: Get the facts you need to protect your clients.
The 2017 Webroot Threat Report provides a uniquely insightful global view into the analysis and discoveries made by the Webroot® Threat Intelligence Platform to provide insights on key trends and risks as seen by our users.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

For many of us, the  holiday season kindles the natural urge to give back to our friends, family members and communities. While it's easy for friends to notice the impact of such deeds, understanding the contributions of businesses and enterprises i…
This program is used to assist in finding and resolving common problems with wireless connections.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
NetCrunch network monitor is a highly extensive platform for network monitoring and alert generation. In this video you'll see a live demo of NetCrunch with most notable features explained in a walk-through manner. You'll also get to know the philos…
Suggested Courses
Course of the Month12 days, 10 hours left to enroll

777 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question