3

I am not able to ping the inside subinterface on my ASA 5508-x.

When setup this way, I am able to ping the interface:

interface GigabitEthernet1/3
 nameif inside
 security-level 100
 ip address X.X.Y.Y

When setup this way, I am unable to ping the interface:

interface GigabitEthernet1/3
 nameif inside
 security-level 100
 no ip address

interface GigabitEthernet1/3.10
 nameif inside1
 security-level 100
 ip address X.X.Y.253

Specifically, I get "Destination host unreachable." Is this a routing problem?

Edit: Here is the config for the port on the switch connecting to the ASA.

interface GigabitEthernet0/1
 no switchport
 ip address X.X.Y.254 

I have tried to configure it as a switchport with access to Vlan10. Open to trying to configure it again if necessary.

Edit: Discovered that you cannot ping from one interface from another on the ASA. Subinterfaces are treated as separate interfaces so this explains why I could not ping once I configured the inside interface as a subinterface.

  • Are you using VLAN 10 in your inside network? And please post the configuration of the port/interface connecting to ASA G1/3. – Hung Tran Feb 20 '18 at 14:47
  • @HungTran I have edited my post. Same Vlan being used. – Racehorse35 Feb 20 '18 at 15:08
  • Are you planning on having multiple sub-interfaces and multiple vlans? The sub-interface on the ASA will need to have a VLAN assigned to it and you would need to send that same VLAN from your switch. What is the end goal, do you want layer 2 or layer 3 connection between the switch and the firewall? – A-A-Ron Feb 20 '18 at 15:18
  • I am trying to replace a production 5505 (9.1) with a 5508 (9.6) with as little switch reconfiguration as possible. When you say the subinterface will need a VLAN assigned to it, do you mean the VLAN between the switch and ASA need to be identical? If so, they are both using VLAN 10. Excuse my ignorance, all my knowledge on this topic is essentially self-taught. When you say L2 vs L3, are you referring to routing? – Racehorse35 Feb 20 '18 at 15:31
  • @A-A-Ron (by the way, hilarious name). After a little digging, I believe I'm looking for a layer 3 link. – Racehorse35 Feb 20 '18 at 15:42
4

After some research I discovered the ASA does not allow pinging from one interface to another. So this explains why I was able to ping the inside interface when it was setup on the physical port but not when it was setup as the VLAN.

Edit: I'll elaborate. If my inside interface:

interface GigabitEthernet0/2
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0

(i.e. GigabitEthernet0/2) is not setup as a VLAN and has an IP of (example) 1.1.1.2, I can ping this interface directly as long as I'm sourcing from the inside (and, of course, on the subnet).

However, if I were to setup a subinterface as the inside:

interface GigabitEthernet0/2
 no nameif
 no security-level
 no ip address
interface GigabitEthernet0/2.10
 vlan 10
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0

I would no longer be able to ping this address because it is treated as cross-interface pinging.

I found this and confirmed with a Cisco rep.

Apologies for the vague answer to begin with.

  • It is true that ASA does not allow cross-interface_IP_Address pinging. However, your statement So this explains why I was able to ping the inside interface when it was setup on the physical port but not when it was setup as the VLAN. has nothing to do with cross-interface_IP_Address pinging. – Hung Tran Feb 22 '18 at 19:26
  • According to Cisco, it does. Edit: The subinterface is treated as a completely separate interface. So it then becomes cross-interface pinging. – Racehorse35 Feb 22 '18 at 19:28
  • I had done exactly that already, it did not work. Traffic might've been allowed, but pinging the interface was not. Because it was cross-interface pinging. – Racehorse35 Feb 22 '18 at 19:58
  • In this whole page of discussion, there is no point you mentioned that you were trying to ping from different VLAN rather than VLAN 10. When you try your laptop from VLAN 10 and your firewall and router/switch are configured as in my answer, then it is in the same interface (L2 traffic), NOT cross-interface. – Hung Tran Feb 22 '18 at 20:14
  • 1
    What we ended up doing was just completely nixing the idea of VLANs (bossman wanted to use them at first, then decided otherwise). So we ended up just putting the config on the interfaces instead of the subinterfaces. Again, thank you for your help. – Racehorse35 Feb 23 '18 at 15:19
2

With your first setup, ASA5508 G1/3 is a routed/L3 interface, you can connect it to L3 port (as you are doing) or to a L2 access switch port (access a VLAN, given that you have its L3 VLAN interface in your network).

With your second setup, you configure ASA5508 G1/3 into sub-interface (encapsulation dot1q), you have to configure the other end, L3 port, as a sub-interface as well (encapsulation dot1q) or a L2 trunk port (trunk a VLAN, given that you have its L3 VLAN interface in your network).

Let us assume you have VLAN 10 and its L3 Interface in your network (in the same IP range with ASA5508 G1/3 interface), the following configuration should work for you. Later, you can trunk more VLANs between firewalls and switch.

### On ASA5508 ###

interface GigabitEthernet1/3
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3.10
 vlan 10
 nameif inside
 security-level 100
 ip address X.X.Y.253
!

### On your switch ###
!
interface GigabitEthernet0/x
 switchport mode trunk
 switchport trunk allow vlan 10
!

When you configure a port into sub-interface, you should not leave any configuration on its main interface.

It would not make any sense if you want to configure the interface on switch as a sub-interface (encapsulation dot1q) as well, because it would give you the same result with the first setup.

  • Matched this config and when I try to ping the inside interface I get "Reply from GATEWAY: Destination host unreachable" – Racehorse35 Feb 20 '18 at 16:28
  • @Racehorse35 Do you have VLAN 10 already on that switch? If no, you need to create it. Then configure another access port in VLAN 10, plug your laptop on that port using an IP address in VLAN 10, then try to ping ASA5508 inside IP address and vice versa ping your laptop from ASA5508. This is L2 traffic, and it should work. – Hung Tran Feb 20 '18 at 19:21
  • @Racehorse35 Another thing, when you put no nameif inside on ASA5508 G1/3, all inside interface configurations (route inside, NAT...) will be gone, so that you have to check and re-apply them back. – Hung Tran Feb 20 '18 at 19:23
  • I've got everything you said set up already, still not working. – Racehorse35 Feb 20 '18 at 19:23
  • To your comment about adding back routes, I learned this the hard way a few days ago. – Racehorse35 Feb 20 '18 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.