Want to protect your cyber security and still get fast solutions? Ask a secure question today.Go Premium

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 1245
  • Last Modified:

PowerConnect 6224 + ASA 5510 Routing

Hi all,

I configued a PowerConnect 6224 layer 3 switch as the gateway of my network.  I configured 6 VLANs which I would like to be able to route out to the internet.  I had routing working with an ASA 5505, but today switched to an ASA 5510 to add the DMZs.  I understand they operate slightly differently.

Both of my configs are attached.  Basically, all intervlan routing is working fine, I just can't get online unless I'm on the .1 subnet.  I can ping the gateway from any subnet, just can't get internet connectivity.

The .1 subnet is directly connected from port #1 to port #1 on the ASA
The .50 subnet is directly connected from port #2 to port #2 on the ASA
The .60 subnet is directly connected from port #3 to port #3 on the ASA

The .20, .30, and .40 subnets are not directly connected.

ASA Version 8.0(4)
!
hostname ciscoasa
enable password c4hP3R3F4CgCXXxJ encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
dns-guard
!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address ***.***.***.*** 255.255.255.***
!
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 192.168.1.1 255.255.255.0
!
interface Ethernet0/2
 nameif dmz1
 security-level 10
 ip address 192.168.50.1 255.255.255.0
!
interface Ethernet0/3
 nameif dmz2
 security-level 10
 ip address 192.168.60.1 255.255.255.0
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
object-group service SQL-Group tcp-udp
 description Various SQL Ports
 port-object eq 66
 port-object eq 118
 port-object eq 150
 port-object eq 156
 port-object eq 1114
 port-object eq 1433
 port-object eq 1434
 port-object eq 1498
 port-object eq 2273
 port-object eq 3306
 port-object eq 5432
access-list inside_nat0_outbound extended permit ip any 192.168.99.0 255.255.255.224
access-list NAT_IT extended permit ip 192.168.1.0 255.255.255.0 any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
mtu dmz2 1500
ip local pool vpnpool 192.168.99.225-192.168.99.254 mask 255.255.255.224
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-61551.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 1 access-list NAT_IT
route outside 0.0.0.0 0.0.0.0 ***.***.***.*** 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map outside_dyn_map 20 set transform-set ESP-3DES-SHA
crypto dynamic-map outside_dyn_map 20 set security-association lifetime seconds 28800
crypto dynamic-map outside_dyn_map 20 set security-association lifetime kilobytes 4608000
crypto map outside_map 65535 ipsec-isakmp dynamic outside_dyn_map
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh timeout 10
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group NEPC type remote-access
tunnel-group NEPC general-attributes
 address-pool vpnpool
tunnel-group NEPC ipsec-attributes
 pre-shared-key *
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns migrated_dns_map_1
 parameters
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns migrated_dns_map_1
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip
  inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:e6e78eeb1455c9794b589e2986f75266
: end
ciscoasa#
 
 
---------
 
 
console#show run
!Current Configuration:
!System Description "Dell 24 Port Gigabit Ethernet, 2.1.1.4, VxWorks5.5.1"
!System Software Version 2.1.1.4
!
configure
vlan database
vlan  101-106
exit
stack
member 1 1
exit
ip address 192.168.2.1 255.255.255.0
ip routing
ip route 0.0.0.0 0.0.0.0 192.168.1.1
interface vlan 101
routing
ip address  192.168.1.254  255.255.255.0
exit
interface vlan 102
routing
ip address  192.168.20.254  255.255.255.0
 
 
exit
interface vlan 103
routing
ip address  192.168.30.254  255.255.255.0
exit
interface vlan 104
routing
ip address  192.168.40.254  255.255.255.0
exit
interface vlan 105
routing
ip address  192.168.50.254  255.255.255.0
exit
interface vlan 106
routing
ip address  192.168.60.254  255.255.255.0
exit
username "admin" password 5fcfd41e547a12215b173ff47fdd3739 level 15 encrypted
!
interface ethernet 1/g1
switchport access vlan 101
 
 
exit
!
interface ethernet 1/g2
switchport access vlan 105
exit
!
interface ethernet 1/g3
switchport access vlan 106
exit
!
interface ethernet 1/g6
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g7
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
 
 
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g8
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g9
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g10
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
 
 
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g11
spanning-tree portfast
switchport mode trunk
switchport trunk allowed vlan add 102-103
switchport trunk allowed vlan remove 1
exit
!
interface ethernet 1/g12
spanning-tree portfast
switchport access vlan 102
exit
!
interface ethernet 1/g13
spanning-tree portfast
switchport access vlan 104
exit
!
interface ethernet 1/g14
 
 
switchport access vlan 105
exit
!
interface ethernet 1/g15
switchport access vlan 105
exit
!
interface ethernet 1/g16
switchport access vlan 105
exit
!
interface ethernet 1/g17
switchport access vlan 106
exit
!
interface ethernet 1/g18
switchport access vlan 106
exit
!
interface ethernet 1/g19
switchport access vlan 106
 
 
exit
!
interface ethernet 1/g22
switchport access vlan 101
exit
!
interface ethernet 1/g23
switchport access vlan 101
exit
!
interface ethernet 1/g24
switchport access vlan 101
exit
exit

Open in new window

0
entegration
Asked:
entegration
  • 2
1 Solution
 
DonbooCommented:
nat (inside) 1 access-list NAT_IT
This define the NAT pool to use for the inside interface and the access-list that is allowed to use that pool.

access-list NAT_IT extended permit ip 192.168.1.0 255.255.255.0 any
This only allows 192.168.1.0 255.255.255.0 so this means that no other is allowed to use the NAT when comming from the inside interface.

Add
access-list NAT_IT extended permit ip 192.168.20.0 255.255.255.0 any
access-list NAT_IT extended permit ip 192.168.30.0 255.255.255.0 any
etc...
or use a any any statement.
0
 
DonbooCommented:
Forgot you also have to add routes to the networks on the firewall.

route inside 192.168.20.0 255.255.255.0 192.168.1.254
route inside 192.168.30.0 255.255.255.0 192.168.1.254
0
 
MAPeelenCommented:
And you have to nat more nat(xx) 1 rules, for now only the inside interface is allowed to use the global adres

so:

nat (dmz1) 1 access-list NAT_IT
nat (dmz2) 1 access-list NAT_IT
0

Featured Post

Get Certified for a Job in Cybersecurity

Want an exciting career in an emerging field? Earn your MS in Cybersecurity and get certified in ethical hacking or computer forensic investigation. WGU’s MSCSIA degree program was designed to meet the most recent U.S. Department of Homeland Security (DHS) and NSA guidelines.  

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now