3

I'm new to ASA and I'm trying my best to get our new VLAN104 (servers) pass through the ASA to the internet. I have a L3 switch which does the inter-vlan routing. Each vlan can ping across each other. Vlan1 (192.168.100.0/24) is directly connected to the ASA and can access the internet fine.

Just recently I created a new vlan104 (id 104) (192.168.104.0/24), and moved some new VMs and storages there. I can ping as far as the core switch (HP 2920) from this new vlan. The ASA doesn't respond or blocks me. The strange thing here is, when I disconnect the 2x access switches (the LAN) from the core switch, connect my laptop straight to the core switch, assign a static VLAN104 IP address (192.168.104.xx), it goes straight to the Internet. The ping replies are fine unless/until I plug back the 2x access switches to the core switches.

Note: the servers and computers are connected to the access switches. Please see the diagram attached for your information. Should you need the configs, I'll post it upon request. Or if my english is not clear, please let me know.

Thank you for any response and assistance.

enter image description here

Here is the current configuration:

ASA Version 9.1(2) 
!
interface GigabitEthernet0/0
 description Outside Interface
 nameif outside
 security-level 0
 ip address 10.15.xx.xx 255.255.255.0 
!
interface GigabitEthernet0/1
 description Inside Interface
 nameif inside
 security-level 100
 ip address 192.168.100.2 255.255.255.0 
!
 domain-name pngngcb.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network inside-outside
 subnet 192.168.100.0 255.255.255.0
 description Inside LAN to Outside
object network 192.168.100.5
 host 192.168.100.5
 description mail-server
object network 192.168.100.103
 host 192.168.100.103
 description mail-server
object network 192.168.100.3
 host 192.168.100.3
 description server
object network vlan104
 subnet 192.168.104.0 255.255.255.0
object-group service DM_INLINE_SERVICE_1
 service-object icmp echo
 service-object icmp6 echo
access-list inside_access_in extended permit object-group DM_INLINE_SERVICE_1 any any 
access-list inside_access_in remark NGCB Server - Mail & File Server
access-list inside_access_in extended permit ip object 192.168.100.5 any 
access-list inside_access_in extended permit ip host 192.168.100.102 any 
access-list inside_access_in extended permit ip host 192.168.100.111 any 
access-list inside_access_in extended permit ip host 192.168.104.11 any 
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network inside-outside
 nat (inside,outside) dynamic interface
 nat (inside,outside) dynamic interface
object network vlan104
 nat (inside,outside) dynamic interface
access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
route outside 0.0.0.0 0.0.0.0 10.15.xx.xx 1
route inside 192.168.104.0 255.255.255.0 192.168.100.9 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
http server enable
http 192.168.1.0 255.255.255.0 management
http 192.168.100.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh timeout 5

!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map 
  inspect ftp 
  inspect h323 h225 
  inspect h323 ras 
  inspect ip-options 
  inspect netbios 
  inspect rsh 
  inspect rtsp 
  inspect skinny  
  inspect esmtp 
  inspect sqlnet 
  inspect sunrpc 
  inspect tftp 
  inspect sip  
  inspect xdmcp 
  inspect icmp 
!

HP 2920 switch
...............
Running configuration:

; J9729A Configuration Editor; Created on release #WB.15.12.0015
; Ver #05:18.41.ff.35.0d:9b

hostname "NGCB-SW4"
module 1 type j9729a
ip default-gateway 192.168.100.2
ip route 0.0.0.0 0.0.0.0 192.168.100.2
ip routing
interface 44
   name "UPLINK_TO_SW#2_LEVEL_2"
   exit
interface 45
   name "LINK_TO_PBX"
   exit
interface 46
   name "PTP_LINK_TO_MOGORU_MOTO"
   exit
interface 47
   name "UPLINK_TO_SW#1_LEVEL_3"
   exit
interface 48
   name "UPLINK_TO_ROUTER"
   exit
snmp-server community "public" unrestricted
oobm
   ip address dhcp-bootp
   exit
vlan 1
   name "DEFAULT_VLAN"
   no untagged 45
   untagged 1-43,48,A1-A2,B1-B2
   tagged 44,46-47
   ip address 192.168.100.9 255.255.255.0
   ip helper-address 192.168.100.103
   exit
vlan 100
   name "VoIP"
   untagged 45
   tagged 1-4,6-44,46-48
   ip address 192.168.50.254 255.255.255.0
   ip helper-address 192.168.100.103
   exit
vlan 104
   name "MANAGEMENT"
   ip address 192.168.104.254 255.255.255.0
   ip helper-address 192.168.100.103
   exit
no tftp server
no autorun
no dhcp config-file-update
no dhcp image-file-update
password manager
  • You need to provide more information. Edit your question to include the sanitized configurations. – Ron Maupin Jun 7 '16 at 3:15
  • Does the ASA have routes to your VLAN subnets? – Ron Trunk Jun 7 '16 at 12:37
  • Have you checked your spanning tree for VLAN 104 when all switches are connected? – dareuja Jun 7 '16 at 16:10
  • @Ron, the ASA has the routes as shown ............................................................................................................... object network inside-outside nat (inside,outside) dynamic interface object network vlan104 nat (inside,outside) dynamic interface access-group outside_access_in in interface outside access-group inside_access_in in interface inside route outside 0.0.0.0 0.0.0.0 10.15.xx.xx 1 route inside 192.168.104.0 255.255.255.0 192.168.100.9 1 timeout xlate 3:00:00 – Ben Pipilyo Jun 8 '16 at 1:12
  • Please post the switch and ASA configs. – Ron Trunk Jun 8 '16 at 1:16
1

VLAN 104 is not tagged on any ports. You need to allow it on the ASA port and the switch uplink ports.

| improve this answer | |
  • but all the vlans can ping each other, PCs are able to get IP addresses via DHCP successfully, I can ping the HP core switch (192.168.100.9) from all the vlans. So I'm thinking the vlans are passing thru' fine on the trunk ports. Pls take note, I haven't created any sub-interfaces for the vlans on the ASA. I just want to use port Gi0/0 port on ASA to allow all the vlans. From vlan1, I can ping everything fine and access the internet. Vlan104 can't ping the ASA and from the ASA I cannot ping the vlan104 interface on the core switch either. How do I tag vlan104 on the ASA? – Ben Pipilyo Jun 18 '16 at 1:49
  • In your switch config, VLAN 104 is not tagged or untagged on any ports. – Ron Trunk Jun 20 '16 at 13:36
  • Sorry for that. I later untagged some ports, still the devices cannot access the Internet. The network icon on the PCs show "connected and Internet access" but actually it just times out. Note, I'm not using sub-interfaces. I'm using one port (192.168.100.2) to try to pass vlans 104 & 103 (192.168.103.xx, 192.168.104.xx) to the internet. I can't even ping the ASA (192.168.100.2) from vlans 104, 103. – Ben Pipilyo Jun 23 '16 at 0:06
  • 1
    There are several things wrong. 1. You don't have a route on the ASA for VLAN 103. 2. You haven't enabled icmp on the ASA.. 3. The ports with servers on VLAN 104 need to have 104 untagged. – Ron Trunk Jun 23 '16 at 1:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.