troubleshooting Question

Cisco 5510 ASA route 2 subnets through same inside interface

Avatar of EvaUnit01
EvaUnit01Flag for United States of America asked on
RoutersHardware FirewallsSwitches / Hubs
13 Comments1 Solution984 ViewsLast Modified:
Hello fellow experts! I need some advice on a problem I have. My network is running out of IPs and after evaluating the different ways to create more IPs I decided to add a new subnet. We have a Cisco ASA 5510 and some 3com Layer 3 switches. We decided not to use Vlans to achieve routing between to the 2 subnets. We added a secondary IP to the 3com switch. We know we have to change the gateway of any device on the original subnet (is now currently the ASA) to the IP of the 3com switch in order to achieve proper internal routing between to the subnets. Here are the specifics of the network below.

Cisco ASA:
Inside interface: 192.168.0.1/24

3com 5500G:
IP: 192.168.0.10/24
2nd IP: 192.168.2.10/24

We have tested routing through the 3com by connecting a workstation to it and manually assigning it an IP of 192.168.2.99 with 192.168.2.10 as the gateway and another with 192.168.0.99 with 192.168.0.10 as its gateway. Traffic goes through fine.

The problem I have is on the Cisco side. It still routes the 192.168.0.0/24 subnet fine with access to the internet and our other sites in different countries(site to site VPNs). The new 192.168.2.0/24 subnet does not seem to have outside access. Since the 3com switch was able to route traffic to a laptop in the 192.168.0.0/24 network it would also reason that it would route to the ASA(same subnet). Obviously all of these devices are connected to the 3com switch directly. So I must be missing something on the ASA.

I have added a dynamic NAT rule on the inside interface to allow traffic from the 192.168.2.0/24 subnet to be translated to the outside interface. Just as there is one already on their for the 192.168.0.0/24 subnet. I am currently working on my ccent/ccna so I am somewhat novice when it comes to this, can another expert point out what I am missing? Also I cannot ping the ASA from the laptop on the 192.168.2.0/24 subnet.

Thanks, Marco.
ASKER CERTIFIED SOLUTION
SIM50

Our community of experts have been thoroughly vetted for their expertise and industry experience.

Join our community to see this answer!
Unlock 1 Answer and 13 Comments.
Start Free Trial
Learn from the best

Network and collaborate with thousands of CTOs, CISOs, and IT Pros rooting for you and your success.

Andrew Hancock - VMware vExpert
See if this solution works for you by signing up for a 7 day free trial.
Unlock 1 Answer and 13 Comments.
Try for 7 days

”The time we save is the biggest benefit of E-E to our team. What could take multiple guys 2 hours or more each to find is accessed in around 15 minutes on Experts Exchange.

-Mike Kapnisakis, Warner Bros