I have the following network which splits a site into a Corp/DMz style network as best I can with the limitations of the ASA in packer tracer. Both routers have static routes to the 10.100.0.0 and 172.16.0.0 networks pointing at the corresponding ASA interfaces and a classless route out the network.
Both ASAs have two static routes. One for the inside network it covers and a classless route to its respective router (ASA1 to R1 and ASA2 to R2). From a machine inside the 10.100.0.0 network I can ping the inside R1 interface at 10.50.6.241. From R1 I can ping the router interface at 200.195.100.2.
However, when I try and ping 200.195.100.2 from a machine inside the 10.100.0.0 network (or ASA1) the packet hits ASA1 and is bounced between the inside 10.50.6.249/30 interface on ASA1 and the outside 10.50.6.244/29 interface on ASA2 inside of ASA1 sending it to R1 as defined by its default route.
Configured ASA1 routes:
route inside 10.100.0.0 255.255.0.0 10.50.6.250 1
route outside 0.0.0.0 0.0.0.0 10.50.6.241 1
ARP output from ASA1
UK-Corp-EP-ASA1#show arp
outside 10.50.6.241 000A.4146.0501
outside 10.50.6.242 0030.F2A0.5101
outside 10.50.6.243 0003.E4BC.38D8
inside 10.50.6.249 0003.E4BC.38D8
inside 10.50.6.250 00D0.BA60.B218
inside 10.100.10.2 00D0.BA60.B218
inside 10.100.10.3 00D0.BA60.B218
outside 172.16.30.4 0002.1612.88E8
Could anyone suggest why this might occur?
EDIT:
As an interesting note. After reopening the file and running and tracert from the PC I get the following result:
PC>tracert 200.195.100.2
Tracing route to 200.195.100.2 over a maximum of 30 hops:
1 0 ms 0 ms 0 ms 10.100.10.1
2 0 ms 0 ms 0 ms 10.50.6.249
3 * 0 ms 1 ms 10.50.6.242
4 37 ms 1 ms 1 ms 200.195.100.6
5 * * * Request timed out.
6 * * * Request timed out.
7 * * * Request timed out.
8 * * * Request timed out.
9 * * * Request timed out.
10
As requested:
R1 interfaces (others are shutdown and not in use)
interface FastEthernet0/0
ip address 10.50.6.241 255.255.255.248
ip nat inside
duplex auto
speed auto
!
interface Serial0/0/0
ip address 200.195.100.1 255.255.255.252
ip nat outside
!
R2 Interfaces
interface FastEthernet0/0
ip address 10.50.6.242 255.255.255.248
ip nat inside
duplex auto
speed auto
!
interface Serial0/0/0
ip address 200.195.100.5 255.255.255.252
ip nat outside
!
Switch Config:
R1 - fa0/24
R2 - fa0/23
ASA1 - fa0/1
ASA2 - fa0/2
UK-EP-Distro-SW1#show int trunk
Port Mode Encapsulation Status Native vlan
Fa0/1 on 802.1q trunking 80
Fa0/2 on 802.1q trunking 80
Fa0/23 on 802.1q trunking 80
Fa0/24 on 802.1q trunking 80
Port Vlans allowed on trunk
Fa0/1 6,10,20,30,80,150
Fa0/2 6,10,20,30,80,150
Fa0/23 6,10,20,30,80,150
Fa0/24 6,10,20,30,80,150
Port Vlans allowed and active in management domain
Fa0/1 6,10,20,30,80,150
Fa0/2 6,10,20,30,80,150
Fa0/23 6,10,20,30,80,150
Fa0/24 6,10,20,30,80,150
Port Vlans in spanning tree forwarding state and not pruned
Fa0/1 6,10,20,30,80,150
Fa0/2 6,10,20,30,80,150
Fa0/23 6,10,20,30,80,150
Fa0/24 6,10,20,30,80,150
UK-EP-Distro-SW1# show vlan brief
VLAN Name Status Ports
---- -------------------------------- --------- -------------------------------
1 default active
5 Default active Fa0/3, Fa0/4, Fa0/5, Fa0/6
Fa0/7, Fa0/8, Fa0/9, Fa0/10
Fa0/11, Fa0/12, Fa0/13, Fa0/14
Fa0/15, Fa0/16, Fa0/17, Fa0/18
Fa0/19, Fa0/20, Fa0/21, Fa0/22
Gig0/1, Gig0/2
6 Routing active
10 UK-Corp-PC active
20 UK-Corp-Server active
30 UK-DMz-Server active
80 Native active
150 VoIP active
1002 fddi-default active
1003 token-ring-default active
1004 fddinet-default active
1005 trnet-default active
If I ping 200.195.100.6 from 10.100.0.0 it will get a reply as ASA1 will send the packet out of R2 (again, not it's default route).
I have considered the possibility of it being a bug in PT. Not a lot I can do about that :(
R1 routing table:
Gateway of last resort is 200.195.100.2 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 2 subnets, 2 masks
C 10.50.6.240/29 is directly connected, FastEthernet0/0
S 10.100.0.0/16 [1/0] via 10.50.6.243
S 172.16.0.0/16 [1/0] via 10.50.6.244
200.195.100.0/30 is subnetted, 1 subnets
C 200.195.100.0 is directly connected, Serial0/0/0
S* 0.0.0.0/0 [1/0] via 200.195.100.2
Ping from PC 10.100.10.2:
PC>tracert 200.195.100.2
Tracing route to 200.195.100.2 over a maximum of 30 hops:
1 1 ms 1 ms 1 ms 10.100.10.1
2 * 0 ms 0 ms 10.50.6.249
3 * * 0 ms 10.50.6.244
4 * 11 ms 11 ms 10.50.6.249
5 11 ms 10 ms 10 ms 10.50.6.244
6 1 ms 12 ms 12 ms 10.50.6.249
7 25 ms 11 ms 26 ms 10.50.6.244
8 13 ms 12 ms 12 ms 10.50.6.249
9 23 ms 22 ms 24 ms 10.50.6.244
10 19 ms 21 ms 26 ms 10.50.6.249
11 24 ms 13 ms 12 ms 10.50.6.244
12 24 ms 24 ms 21 ms 10.50.6.249
13 34 ms 10 ms 23 ms 10.50.6.244
14 22 ms 33 ms 43 ms 10.50.6.249
Dropbox link for the file. As an update since this discussion I have changed the interfaces on the switch from trunks to sit on routing vlan 6.
https://www.dropbox.com/sh/kt5x03j1kckf9bw/AABdlTWqvyUNQer-O-t_AAv7a?dl=0
