ASA 5510 - Routing issues between sub-intefaces

IvanY
IvanY used Ask the Experts™
on
Used to have Cisco 1811 as my router and gateway, but had some issue with VPN tunnels, decided to use ASA 5510, 9.1(6), Security Plus lic instead.
Have a network with eth0/0 (internet), eth 0/1 (data) and eth 0/2 (voice).

Issue: I can ping both internal networks from ASA, but not between networks.

interface Ethernet0/0
 nameif outside
 security-level 0
 ip address xxx.xxx.xxx.xxx 255.255.255.240
!            
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 172.22.35.19 255.255.255.0
!
interface Ethernet0/2
 nameif voice
 security-level 100
 ip address 10.0.1.3 255.255.255.0

Attached is my full config. I'm new to ASA (ok with IOS) and most help I find to resolve is for pre-8.3 ASA.
Thank you!
ASA5510-upload.txt
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Hi,

Welcome to ASA world !
Actually still you need to do NAT config in the device which will allow traffic and will not translate the ip addresses as shown in the below config.The packets will traverse between INSIDE and VOICE interfaces
and will have their original ip addresses.
Paste the below commands in the cli.

config terminal
object network inside
subnet 172.22.35.0 255.255.255.0
nat (inside,voice) static 172.22.35.0
object network voice
subnet 10.0.1.0 255.255.255.0
nat (voice,inside) static 10.0.1.0
Hi!

try to add the following commands

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface

the ASA would usually block traffic from interfaces with the same security level by default.

Just a comment on the NAT. By default, if you do not configure NAT for 8.2 or higher codes, it will do NAT0, so unless you added a NAT statement which are hitting traffic from "inside" to "voice" interface, you dont really need to add NAT statements.

Author

Commented:
Thank you.
Added NAT as shown above.
Already had same-security-traffic lines.
Still no luck.
Trying to ping 172.22.35.19 from ASDM using ALL or INSIDE interface - 100% success. If I specify VOICE - no ping.
Pinging 10.0.1.3 or 10.0.1.4 (computer behind the interface) on ALL or VOICE interface - fine, INSIDE - nothing.

Attached is an updated config.
ASA5510-upload.txt
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

try adding an access-list for the interfaces like so

access-list inside extended permit icmp 172.22.35.0 255.255.255.0 any
access-list inside extended permit ip 172.22.35.0 255.255.255.0 any
!
access-list voice extended permit icmp 10.0.1.0 255.255.255.0 any
access-list voice extended permit ip 10.0.1.0 255.255.255.0 any
!
access-group inside interface inside in
access-group voice interface voice in

Author

Commented:
Still no luck. Please help. I'm going crazy.
It irritates me to no end that such simple task as routing between 2 internal interfaces takes so much effort!!!

Author

Commented:
OK. I just reset ASA to factory default and assigned IP addresses to ports.

!
interface Ethernet0/0
 nameif outside
 security-level 0
 ip address xxx.xxx.xxx.xxx 255.255.255.240
!            
interface Ethernet0/1
 nameif inside
 security-level 100
 ip address 172.22.35.19 255.255.255.0
!
interface Ethernet0/2
 nameif voice
 security-level 100
 ip address 10.0.1.3 255.255.255.0

Checked "Enable traffic between two or more interfaces which are configured with same security levels"
Checked "Enable traffic between two or more hosts connected to the same interface"

No ping between interfaces. I'm stuck.
Distinguished Expert 2018

Commented:
By default icmp is not inspected traffic. ASA need to inspect icmp or ping will be dropped.

policy-map global_policy
 class inspection_default
  inspect icmp
  exit
 exit

GUI

Author

Commented:
Added. No ping between INSIDE and VOICE.
Attached is current config (all default except for interfaces and ICMP inspection)
ASA5510-upload.txt
Distinguished Expert 2018

Commented:
Additional Guidelines

    - The ASA does not respond to ICMP echo requests directed to a broadcast address.
    - The ASA only responds to ICMP traffic sent to the interface that traffic comes in on; you cannot send ICMP traffic through an interface to a far interface.
    - If you cannot ping the ASA interface, make sure that you enable ICMP to the ASA for your IP address using the icmp command.
Try to strictly permit icmp - Cisco - ASA 9.0

icmp { permit | deny } { host ip_address | ip_address mask | any } [ icmp_type ] interface_name
icmp permit any inside

Author

Commented:
I added:
icmp permit any inside
icmp permit any voice

No ping. I'm trying to ping 172.22.35.19 using VOICE (using ASDM Ping) - no ping. If I use INSIDE - works.
When trying to ping 10.0.1.3 using INSIDE - no ping. If I use VOICE - works.

I can ping OUTSIDE interface using both INSIDE and VOICE. I'm assuming that works because I added natting to it:
object network inside
 subnet 172.22.35.0 255.255.255.0
object network voice
 subnet 10.0.1.0 255.255.255.0
object network NAT_voice-outside
 subnet 10.0.1.0 255.255.255.0
object network NAT_inside-outside
 subnet 172.22.35.0 255.255.255.0
object network outside
 subnet xxxxxxxxxxxxxx 255.255.255.240

object network NAT_voice-outside
 nat (voice,outside) dynamic interface
object network NAT_inside-outside
 nat (inside,outside) dynamic interface
route outside 0.0.0.0 0.0.0.0 xxxxxxxxxxxxx 1

I tried to add NAT between INSIDE and VOICE - but ASA tells me that I can't add because it already exists? If it does, why doesn't it work?

I'm stuck. It's been a week. I understand I'm newbie with ASA, but I'm getting quite discouraged. Please help.
Check the routing from your router to asa on both inside and voice zone...
is there route present to reach to firewall
even if it is directly connected try to give static route toward the firewall
It is required for return traffic..
You can try this.....

Author

Commented:
Apparently I can ping between the subnets, except for far interface IP address.

Meaning from INSIDE I can ping everything on the INSIDE net, (including INSIDE interface IP) and everything OUTSIDE (excluding OUTSIDE interface IP).
Same goes for VOICE - everything on VOICE and INSIDE, except INSIDE interface IP.

And of course, those interface IP's are what I was trying to test ping all along.

Thanks everyone involved.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial