3

I am not able to ping the inside subinterface on my ASA 5508-x.

When setup this way, I am able to ping the interface:

interface GigabitEthernet1/3
 nameif inside
 security-level 100
 ip address X.X.Y.Y

When setup this way, I am unable to ping the interface:

interface GigabitEthernet1/3
 nameif inside
 security-level 100
 no ip address

interface GigabitEthernet1/3.10
 nameif inside1
 security-level 100
 ip address X.X.Y.253

Specifically, I get "Destination host unreachable." Is this a routing problem?

Edit: Here is the config for the port on the switch connecting to the ASA. 

interface GigabitEthernet0/1
 no switchport
 ip address X.X.Y.254

I have tried to configure it as a switchport with access to Vlan10. Open to trying to configure it again if necessary.

Edit: Discovered that you cannot ping from one interface from another on the ASA. Subinterfaces are treated as separate interfaces so this explains why I could not ping once I configured the inside interface as a subinterface.

Improve this question
8
  • Are you using VLAN 10 in your inside network? And please post the configuration of the port/interface connecting to ASA G1/3.
    – Hung Tran
    Feb 20, 2018 at 14:47
  • @HungTran I have edited my post. Same Vlan being used.
    – Racehorse35
    Feb 20, 2018 at 15:08
  • Are you planning on having multiple sub-interfaces and multiple vlans? The sub-interface on the ASA will need to have a VLAN assigned to it and you would need to send that same VLAN from your switch. What is the end goal, do you want layer 2 or layer 3 connection between the switch and the firewall?
    – A-A-Ron
    Feb 20, 2018 at 15:18
  • I am trying to replace a production 5505 (9.1) with a 5508 (9.6) with as little switch reconfiguration as possible. When you say the subinterface will need a VLAN assigned to it, do you mean the VLAN between the switch and ASA need to be identical? If so, they are both using VLAN 10. Excuse my ignorance, all my knowledge on this topic is essentially self-taught. When you say L2 vs L3, are you referring to routing?
    – Racehorse35
    Feb 20, 2018 at 15:31
  • @A-A-Ron (by the way, hilarious name). After a little digging, I believe I'm looking for a layer 3 link.
    – Racehorse35
    Feb 20, 2018 at 15:42

2 Answers 2

Reset to default
4

After some research I discovered the ASA does not allow pinging from one interface to another. So this explains why I was able to ping the inside interface when it was setup on the physical port but not when it was setup as the VLAN.

Edit: I'll elaborate. If my inside interface:

interface GigabitEthernet0/2
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0

(i.e. GigabitEthernet0/2) is not setup as a VLAN and has an IP of (example) 1.1.1.2, I can ping this interface directly as long as I'm sourcing from the inside (and, of course, on the subnet).

However, if I were to setup a subinterface as the inside:

interface GigabitEthernet0/2
 no nameif
 no security-level
 no ip address
interface GigabitEthernet0/2.10
 vlan 10
 nameif inside
 security-level 100
 ip address 1.1.1.2 255.255.255.0

I would no longer be able to ping this address because it is treated as cross-interface pinging.

I found this and confirmed with a Cisco rep.

Apologies for the vague answer to begin with.

Improve this answer
7
  • It is true that ASA does not allow cross-interface_IP_Address pinging. However, your statement So this explains why I was able to ping the inside interface when it was setup on the physical port but not when it was setup as the VLAN. has nothing to do with cross-interface_IP_Address pinging.
    – Hung Tran
    Feb 22, 2018 at 19:26
  • According to Cisco, it does. Edit: The subinterface is treated as a completely separate interface. So it then becomes cross-interface pinging.
    – Racehorse35
    Feb 22, 2018 at 19:28
  • I had done exactly that already, it did not work. Traffic might've been allowed, but pinging the interface was not. Because it was cross-interface pinging.
    – Racehorse35
    Feb 22, 2018 at 19:58
  • In this whole page of discussion, there is no point you mentioned that you were trying to ping from different VLAN rather than VLAN 10. When you try your laptop from VLAN 10 and your firewall and router/switch are configured as in my answer, then it is in the same interface (L2 traffic), NOT cross-interface.
    – Hung Tran
    Feb 22, 2018 at 20:14
  • 1
    What we ended up doing was just completely nixing the idea of VLANs (bossman wanted to use them at first, then decided otherwise). So we ended up just putting the config on the interfaces instead of the subinterfaces. Again, thank you for your help.
    – Racehorse35
    Feb 23, 2018 at 15:19
2

With your first setup, ASA5508 G1/3 is a routed/L3 interface, you can connect it to L3 port (as you are doing) or to a L2 access switch port (access a VLAN, given that you have its L3 VLAN interface in your network).

With your second setup, you configure ASA5508 G1/3 into sub-interface (encapsulation dot1q), you have to configure the other end, L3 port, as a sub-interface as well (encapsulation dot1q) or a L2 trunk port (trunk a VLAN, given that you have its L3 VLAN interface in your network).

Let us assume you have VLAN 10 and its L3 Interface in your network (in the same IP range with ASA5508 G1/3 interface), the following configuration should work for you. Later, you can trunk more VLANs between firewalls and switch.

### On ASA5508 ###

interface GigabitEthernet1/3
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet1/3.10
 vlan 10
 nameif inside
 security-level 100
 ip address X.X.Y.253
!

### On your switch ###
!
interface GigabitEthernet0/x
 switchport mode trunk
 switchport trunk allow vlan 10
!

When you configure a port into sub-interface, you should not leave any configuration on its main interface.

It would not make any sense if you want to configure the interface on switch as a sub-interface (encapsulation dot1q) as well, because it would give you the same result with the first setup.

Improve this answer
6
  • Matched this config and when I try to ping the inside interface I get "Reply from GATEWAY: Destination host unreachable"
    – Racehorse35
    Feb 20, 2018 at 16:28
  • @Racehorse35 Do you have VLAN 10 already on that switch? If no, you need to create it. Then configure another access port in VLAN 10, plug your laptop on that port using an IP address in VLAN 10, then try to ping ASA5508 inside IP address and vice versa ping your laptop from ASA5508. This is L2 traffic, and it should work.
    – Hung Tran
    Feb 20, 2018 at 19:21
  • @Racehorse35 Another thing, when you put no nameif inside on ASA5508 G1/3, all inside interface configurations (route inside, NAT...) will be gone, so that you have to check and re-apply them back.
    – Hung Tran
    Feb 20, 2018 at 19:23
  • I've got everything you said set up already, still not working.
    – Racehorse35
    Feb 20, 2018 at 19:23
  • To your comment about adding back routes, I learned this the hard way a few days ago.
    – Racehorse35
    Feb 20, 2018 at 19:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.