Solved

cisco asa5506 traffic between interfaces

Posted on 2016-08-27
9
41 Views
Last Modified: 2016-09-06
how do you allow interfaces on asa5506 to allow traffic?  i see a check mark there and also ensure the security levels are the same but i cant ping either subnett of each interfaces.

appreciate your time....

thanks,
0
Comment
Question by:mwauki
  • 4
  • 4
9 Comments
 
LVL 90

Expert Comment

by:John Hurst
ID: 41772891
Are the two machines together in the same office / area, or are they separated by the internet and in different locations. In the latter case, you would need to set up a VPN connection to connect the devices.
0
 
LVL 28

Accepted Solution

by:
Jan Springer earned 500 total points
ID: 41772975
Each interface on a 5506 is routed and will have its own nameif with a security level.

You will create ACLs for the traffic inbound to the ASA for the permitted actions and deny all else for that subnet, then permit everything (rule order is important).

You may also need the "same-security-traffic permit inter-interface" or "same-security-traffic permit intra-interface".

If you can specific, we can help craft rules.
0
 

Author Comment

by:mwauki
ID: 41773282
thanks! ok, here it is:
asa5506, gigabit1/2 & 1/3,  on same unit.  
ips: g1/2=192.168.1.0/24  ,  g1/3=192.168.2.0/24

i'v ran "same-security-traffic permit intra-interface" and i can see that both interfaces are able to exchange traffic now.  however, when i created a vpn from this unit(siteA) to another unit (siteB), only devices on g1/2 gets a successful ping accross to siteB.  SiteB also gets a successful ping only to devices on g1/2.  

vpn (site-site): siteA g1/2 & g1/3 are under one networkobject as a network.

windows firewall is turned off on all involve stations.

please let me know if you need more info.

thanks,
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41773291
Does the ACL for the VPN include both subnets?

Are but subnets excluded from NAT?
0
What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

 

Author Comment

by:mwauki
ID: 41773684
isn't ACL auto created once the vpn is configured and online?  sorry, just trying to understand this...

i can see that my ACL has the default entries.  unless am looking at a wrong place... please advise.

thanks,
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41773841
You have to define somewhere the local and remote "interesting" subnets for encryption.

I don't use ASDM, so if that's what you're using, I won't be of much help.

If you post a sanitized configuration, that would give me somewhere to start.
0
 

Author Comment

by:mwauki
ID: 41774178
ok.  any specific part of the running config?  i can do a lil from the cli... would you be able to show me the cli command need to run for this particular ?
0
 
LVL 28

Expert Comment

by:Jan Springer
ID: 41774753
term pag 0
sh run

Then do an X.X for the first two octets of the public IP(s).  

Delete all line that contain: passwords, keys, usernames, logging, snmp, etc.

We're only interested in any detail that involves routing to include access lists.  So, if you're using objects and object-groups, I'll need that detail.  If you don't want it publicly published, sent it to my EE mailbox.  I'll look at it and respond back here.
0
 

Author Comment

by:mwauki
ID: 41775784
ok. sent it to your message box
0

Featured Post

How to run any project with ease

Manage projects of all sizes how you want. Great for personal to-do lists, project milestones, team priorities and launch plans.
- Combine task lists, docs, spreadsheets, and chat in one
- View and edit from mobile/offline
- Cut down on emails

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Cisco ASA 5506 5 38
Route summarization 5 21
Cisco WLC: Blocking specific MAC address 3 39
Cisco vlan question 12 39
There are many useful and sometimes not well documented or forgotten IOS or ASA/PIX commands. See IPE article here , there was also one on PacketU and on Cisco Tips & Tricks. Below are my favorites. I give also a few most often used for Cisco IPS an…
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
Access reports are powerful and flexible. Learn how to create a query and then a grouped report using the wizard. Modify the report design after the wizard is done to make it look better. There will be another video to explain how to put the final p…
When you create an app prototype with Adobe XD, you can insert system screens -- sharing or Control Center, for example -- with just a few clicks. This video shows you how. You can take the full course on Experts Exchange at http://bit.ly/XDcourse.

708 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now