1

I have a 3560 Core switch linked to a 2960 Transmittor switch. I made VLAN 10 on the 3560 with ip address 192.168.1.11 and I also made vlan 10 on the 2960 with ip address 192.168.1.12, so they are in the same subnet. I than made an "inside" subinterface on the firewall with ip address 192.168.1.10, but I am unable to ping the firewall subinterface ip from my 3560 switch. I have provided all the configurations for all the devices. Please help! Here is my config for the firewall(5520 ASA):

This is the configuration for the firewall, 

ciscoasa#  sh run
: Saved
:
: Serial Number: JMX1131L1ZU
: Hardware:   ASA5520, 2048 MB RAM, CPU Pentium 4 Celeron 2000 MHz
:
ASA Version 9.1(7)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet0/0
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/0.1
 vlan 5
 nameif inside
 security-level 100
 ip address 192.168.1.10 255.255.255.0
!
interface GigabitEthernet0/0.2
 vlan 6
 nameif outside
 security-level 0
 ip address 192.168.2.10 255.255.255.0
!
interface GigabitEthernet0/0.3
 vlan 7
 nameif dmz
 security-level 50
 ip address 192.168.3.10 255.255.255.0
!
interface GigabitEthernet0/1
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 shutdown
 no nameif
 no security-level
 no ip address
!
ftp mode passive
pager lines 24
mtu inside 1500
mtu outside 1500
mtu dmz 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
no call-home reporting anonymous
call-home
 profile CiscoTAC-1
  no active
  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
  destination address email callhome@cisco.com
  destination transport-method http
  subscribe-to-alert-group diagnostic
  subscribe-to-alert-group environment
  subscribe-to-alert-group inventory periodic monthly
  subscribe-to-alert-group configuration periodic monthly
  subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:6287e0f52613b8763af300eae4849745
: end
ciscoasa#

2960 Switch(Transmittor switch)-

Transmittor#sh run
Building configuration...
Current configuration : 1913 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Transmittor
!
!
no aaa new-model
system mtu routing 1500
vtp mode transparent
ip subnet-zero
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
vlan 10,20,30,40,112-113
!
vlan 210
 name netmon
!
vlan 439
 name radio
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface GigabitEthernet0/13
!
interface GigabitEthernet0/14
!
interface GigabitEthernet0/15
!
interface GigabitEthernet0/16
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
!
interface GigabitEthernet0/21
 switchport access vlan 10
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,40
 switchport mode trunk
!
interface GigabitEthernet0/22
 switchport access vlan 10
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10,20,30,40
 switchport mode trunk
!
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface Vlan1
 no ip address
 no ip route-cache
!
interface Vlan10
 ip address 192.168.1.12 255.255.255.0
 no ip route-cache
!
interface Vlan20
 ip address 192.168.20.14 255.255.255.0
 no ip route-cache
!
interface Vlan30
 ip address 192.168.30.14 255.255.255.0
 no ip route-cache
!
interface Vlan40
 ip address 192.168.40.14 255.255.255.0
 no ip route-cache
!
ip http server
!
control-plane
!
!
line con 0
line vty 0 4
 password abc
 login
line vty 5 15
 login
!
end

Output for 3560 Switch:

Switch#sh run
Building configuration...

Current configuration : 1704 bytes
!
version 12.2
no service pad
service timestamps debug uptime
service timestamps log uptime
no service password-encryption
!
hostname Switch
!
!
no aaa new-model
system mtu routing 1500
ip subnet-zero
!
!
!
!
no file verify auto
spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!
!
interface GigabitEthernet0/1
!
interface GigabitEthernet0/2
!
interface GigabitEthernet0/3
!
interface GigabitEthernet0/4
!
interface GigabitEthernet0/5
!
interface GigabitEthernet0/6
!
interface GigabitEthernet0/7
!
interface GigabitEthernet0/8
!
interface GigabitEthernet0/9
!
interface GigabitEthernet0/10
!
interface GigabitEthernet0/11
!
interface GigabitEthernet0/12
!
interface GigabitEthernet0/13
!
interface GigabitEthernet0/14
!
interface GigabitEthernet0/15
!
interface GigabitEthernet0/16
!
interface GigabitEthernet0/17
!
interface GigabitEthernet0/18
!
interface GigabitEthernet0/19
!
interface GigabitEthernet0/20
!
interface GigabitEthernet0/21
!
interface GigabitEthernet0/22
!
interface GigabitEthernet0/23
!
interface GigabitEthernet0/24
!
interface GigabitEthernet0/25
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10
 switchport mode trunk
!
interface GigabitEthernet0/26
!
interface GigabitEthernet0/27
 switchport access vlan 10
 switchport trunk encapsulation dot1q
 switchport trunk native vlan 99
 switchport trunk allowed vlan 10
 switchport mode trunk
!
interface GigabitEthernet0/28
!
interface Vlan1
 no ip address
!
interface Vlan10
 ip address 192.168.1.11 255.255.255.0
!
ip classless
ip http server
!
!
!
control-plane
!
!
line con 0
line vty 5 15
!
end

Switch#
Improve this question
8
  • A drawing would be useful, as well as full (sanitized) configurations.
    – Ron Maupin ♦
    Jul 21, 2016 at 17:59
  • @RonMaupin please review the page, I just uploaded my drawing. And I am working with real equipment.
    – Stan234
    Jul 21, 2016 at 18:08
  • What are the links from the core switches to the firewall (trunks, routed links)? What about the link to the router? Where are you intending to route traffic between the VLANs (core switches, firewall, router)? If it is the core switches, are they layer-3 switches and configured as such? You really need to provide a lot more information, and full configurations will help a lot.
    – Ron Maupin ♦
    Jul 21, 2016 at 18:16
  • The links from the core switch to the firewall are trunks, 2 ethernet cables which 1 connects to gi0/0 of the firewall for inside addressing and gi0/1 for public outside addressing, the 3560s are layer 3 switches yeah, its just the 2960 that is layer 2. I dont have the router portion actually set up yet. I am just trying to ping the vlans from the firewall to see if its pinging.
    – Stan234
    Jul 21, 2016 at 18:21
  • Did you define the VLANs and assign addresses on the firewall? Please post full configurations, then we don't need to play 20 questions. That's not how this site works. You need to provide all the necessary and relevant information for us to help you solve the problem. People are likely to just give up and ignore your question if they don't have what they need to help you.
    – Ron Maupin ♦
    Jul 21, 2016 at 18:35

2 Answers 2

Reset to default
1

You need to create subinterfaces on the ASA for each VLAN. The subintefaces act like VLAN interface on the switch. This effectively turns your inside interface into a trunk. For example:

interface gi0/0
no ip address

interface gi0/0.10
vlan 10
nameif VLAN10
ip address 1.1.1.1 255.255.255.0
Improve this answer
5
  • how does the firewall detect the vlans from the other switches? I have made vlan 10, 20, 30, 40 on the other 2 3560s and the 2960, and I cant do the "nameif vlan10" on the firewall it says ' ERROR: VLAN must be configured for interface GigabitEthernet0/0.10 "
    – Stan234
    Jul 21, 2016 at 19:48
  • I corrected the config. If you're trunking the vlans to the firewall, each vlan is tagged with a vlan ID (VID). When you specify the vlan command in the subinterface, you're telling the ASA which tag to pay attention to. In this case, vlan 10.
    – Ron Trunk
    Jul 21, 2016 at 19:54
  • does the ip address of the sub interface matter, how do i know its paying attention to vlan 10 from the other switch
    – Stan234
    Jul 21, 2016 at 19:55
  • Yes. You need an IP address on each vlan that goes through the firewall. When you created vlan 10 on the switch, that means it will be tagged with VID 10 whenever it's on a trunk.
    – Ron Trunk
    Jul 21, 2016 at 19:57
  • yeah i gave the vlans on the switches ip addresses, but how can i verify its communicating? do i ping the ip of the subinterface?
    – Stan234
    Jul 21, 2016 at 20:18
0

Since I don't understand your ultimate plan, I will give you a couple of other options.

What Ron Trunk is giving you is what you should do if you route between the VLANs on the firewall. You will somehow need to let the router know what routes are behind the firewall. You can either use static routes (doesn't scale) or a routing protocol to tell the router what routes are behind the core switches. You could run OSPF on the the firewall, and the router, and you could inject a default route into OSPF on the router.

If you have layer-3 core switches, and you want to route between the VLANs on the core switches (may be better than on the firewall or the router), you should enable routing on the layer-3 switches, then set up routed links, not trunks, between the core switches and the firewall. The firewall and the router will then need to know what networks are behind the core switches. You can either use static routes (doesn't scale) or a routing protocol to tell the firewall and router what routes are behind the core switches. You could run OSPF on the core switches, the firewall, and the router, and you could inject a default route into OSPF on the router.

Your third option is to route between the VLANs on the router. If you route between the VLANs on the router (probably the least attractive option), you will need to set up the firewall as a transparent firewall so that the VLANs can pass through from the core switches to the router. You would then need to set up the VLANs and addresses on the router in a similar way (subinterfaces) that Ron told you to do for the firewall.

Improve this answer
6
  • im trying to create a network, with a firewall, so i want to see if the vlan data is reaching the firewall first. i than want to make the network "inside" and everything coming into the firewall "outside" im just not sure how to do all this
    – Stan234
    Jul 21, 2016 at 20:29
  • You don't want everything coning into the firewall as outside. Normally, you want the LAN as the inside, so it connects to an inside interface on the firewall. The other side of the firewall is outside. You have some options which you need to weigh. Testing as you are now is only telling you that the first option may work. If you want the second or third options, this test really tells you nothing about how they may work. You really need to make the design decisions first, then work on testing and implementing them.
    – Ron Maupin ♦
    Jul 21, 2016 at 20:49
  • @Stan234, you need to decide where you want to route between the VLANs: core switches, firewall, or router. Once you know that, then your other options are narrowed and become more clear.
    – Ron Maupin ♦
    Jul 21, 2016 at 20:52
  • I want the vlans i made to route to the firewalls, how do i do that , i made vlans 10,20,30,40 on the core switch, i want it to reach the firewall, i made the subinterfaces and made the same vlans so it can route to it
    – Stan234
    Jul 21, 2016 at 21:53
  • Yes, you can have the VLANs route to the firewall, but that's not the relevant question: where are you going to route between the VLANs? Do you want the firewall to be the router and the firewall? Do you want the core switches to handle the VLAN routing to take that burden off the firewall CPU, or do you want the router to handle routing between the VLANs, too? If you trunk to the firewall, you really are not routing to the firewall.
    – Ron Maupin ♦
    Jul 21, 2016 at 21:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.