winningtech
asked on
Cisco ASA 5200 - Subinterfaces with VLAN's. Problem getting VLANS to communicate with one another.
Folks,
I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another. The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data. I'd like VLAN 20 to be able to NAT outside and have this functioning. VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN. VLAN 10 and 20 need to be able to communicate.
The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.
Config pasted below. Help appreciated.
sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
description Test
nameif inside
security-level 100
no ip address
!
interface GigabitEthernet0/1.10
description Disk Array Interface
vlan 10
nameif DiskArray
security-level 100
ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
description VMware Server interface
vlan 20
nameif VMServers
security-level 100
ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 10.100.101.254 255.255.255.0
management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101. 150 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc5 9c05224041 c45df58e7c b
: end
TIA!
I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another. The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data. I'd like VLAN 20 to be able to NAT outside and have this functioning. VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN. VLAN 10 and 20 need to be able to communicate.
The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.
Config pasted below. Help appreciated.
sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
description Test
nameif inside
security-level 100
no ip address
!
interface GigabitEthernet0/1.10
description Disk Array Interface
vlan 10
nameif DiskArray
security-level 100
ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
description VMware Server interface
vlan 20
nameif VMServers
security-level 100
ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 10.100.101.254 255.255.255.0
management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101.
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map global_policy
class inspection_default
inspect dns maximum-length 512
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc5
: end
TIA!
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
That didn't seem to work. If anyone else has a thought I'd appreciate it!
ASKER
Actually, it was very close to the solution.
What worked was:
access-list DiskArray_nat0_outbound extended permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list VMServers_nat0_outbound extended permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0
and
nat (DiskArray) 0 access-list DiskArray_nat0_outbound
nat (VMServers) 0 access-list VMServers_nat0_outbound
Will award points as it put me onto the right track.
Thanks!
What worked was:
access-list DiskArray_nat0_outbound extended permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list VMServers_nat0_outbound extended permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0
and
nat (DiskArray) 0 access-list DiskArray_nat0_outbound
nat (VMServers) 0 access-list VMServers_nat0_outbound
Will award points as it put me onto the right track.
Thanks!
ASKER