1

I am setting up a new remote office setup with an ASA5520 to a Cisco 2960X switch. I subinterfaced the the ASA inside to allow the Wired and Wireless subnets. On the 2960 I created a Vlan 100 for the wired and Vlan 200 for the wireless. I can ping downstream from the ASA to the switch to both the Vlan100 and Vlan200.

On the switch I can ping upstream to the ASA via vlan100 as it is on the same subnet but I cannot ping upstream from Vlan 200. I thought maybe a ip route statement would work but still no go. Thanks for any insight.

ASA

interface GigabitEthernet0/0
 description INSIDE
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/0.1
 vlan 100
 nameif inside
 security-level 100
 ip address 192.168.2.1 255.255.255.0 
!
interface GigabitEthernet0/0.2
 vlan 200
 nameif Wireless
 security-level 100
 ip address 192.168.3.1 255.255.255.0

2960X

interface FastEthernet0
no ip address
!
interface GigabitEthernet1/0/1
switchport access vlan 100
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/2
switchport access vlan 100
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/3
switchport access vlan 100
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/4
switchport access vlan 100
switchport mode access
spanning-tree portfast
!
interface GigabitEthernet1/0/5
switchport access vlan 100
switchport mode access
spanning-tree portfast
!

UP to 1/0/44 the same

    interface GigabitEthernet1/0/45
    description WIRELESS WAPS
    switchport trunk native vlan 100
    switchport mode trunk
    spanning-tree portfast
   !
 ` interface GigabitEthernet1/0/46
   description WIRELESS WAPS
   switchport trunk native vlan 100
   switchport mode trunk
   spanning-tree portfast
   !
  interface GigabitEthernet1/0/47
  description Connection to ASA
  switchport mode trunk
  !
  interface GigabitEthernet1/0/48
  description X-Connect to Sw2
  switchport mode trunk
!
interface GigabitEthernet1/0/49
!         
interface GigabitEthernet1/0/50
!
interface GigabitEthernet1/0/51
!
interface GigabitEthernet1/0/52
!
interface Vlan1
 no ip address
!
interface Vlan100
 ip address 192.168.2.5 255.255.255.0

!
interface Vlan200
 ip address 192.168.3.5 255.255.255.0

!
ip default-gateway 192.168.2.1
ip http server
ip http secure-server
!
ip route 192.168.3.0 255.255.255.0 192.168.2.1``
Improve this question
5
  • The ASA can route. I think what you need to see is if you can ping from a host on VLAN 100 to a host on VLAN 200. There is something about the ASA and pinging a different interface on the ASA itself that can be a problem.
    – Ron Maupin ♦
    Nov 26, 2018 at 19:49
  • Yes, I just tested I can ping 192.168.2.5 (Vlan100) with a source Vlan200 SW1#ping 192.168.2.5 source vlan200 !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/3 ms
    – tf09
    Nov 26, 2018 at 19:53
  • VLANs 100 and 200 would communicate through the ASA, unless you enable routing on the switch. If you do local LAN routing on the switch, you should really set up a routed link between the switch and ASA, and you would either need static routes on the ASA pointing to the switch for the networks behind the switch, or you would need to run a routing protocol between the ASA and switch. I would actually do local LAN routing on the switch with a routed link to the ASA, unless you need a firewall separating the VLANs.
    – Ron Maupin ♦
    Nov 26, 2018 at 20:00
  • Ok, so maybe I am confusing myself here. I can source ping 192.168.3.1 from Vlan200(192.168.3.5) and I can source ping 192.168.2.1 from Vlan100(192.168.2.5) ... that seems correct and both cannot talk to each out when I try to ping those gateways from the other vlan. What do you mean a routed link to ASA, I have the default gateway as the wired/ASA should I remove that and just put ip route statements on the 2960? Thanks again for the help.
    – tf09
    Nov 26, 2018 at 20:38
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer.
    – Ron Maupin ♦
    Dec 25, 2018 at 10:08

2 Answers 2

Reset to default
1

What I was explaining before it that trying to ping an ASA interface from a different network can be a problem. That is a security thing. What you seem to want is to be able to communicate between the VLANs, and that seems to work for you, so all is good.

As far as where you route between VLANs, that is really up to you. If you are comfortable with using the ASA as a LAN router, then that is fine. Many people use the aggregation switch (the one connected directly to the ASA) as the LAN router. To do that, you have a separate, small network that goes from the ASA interface (no VLAN or subinterfaces on the ASA) to the switch interface that is configured with the no switchport command and an IP address configured on the interface. You would also enable routing with the ip routing command on the switch.

The hitch with doing that is that the ASA has no idea where to send traffic for the networks on the other side of the switch, so it needs to be specifically told, either with static routes (doesn't scale if you have a lot of VLANs), or you could run a routing protocol between the ASA and the switch. This will relieve the ASA the burden of routing LAN traffic, so it is useful if most of your traffic is local.

Improve this answer
2
  • This is a small office I am going to spin up so I think an ASA5520 to 2960Xs will be fine. My main question would be related to the Guest Network 192.168.3.0/24, I do not want this network to talk to the internal 192.168.2.0/24 network, pretty much all I want is it to be an outside access for basic internet connectivity. If I lower the security level to under 100 that will remove that possibility of talking to the internal 192.168.2.0/24 network but for to allow it outside I need to drop a NAT in.
    – tf09
    Dec 4, 2018 at 15:17
  • Can I dynamically NAT that guest out of the same PAT? right now I have a nat (inside,outside) dynamic interface for the internal 192.168.2.0/24.
    – tf09
    Dec 4, 2018 at 15:17
1

For starters ip route 192.168.3.0 255.255.255.0 192.168.2.1 on the switch is nonsense. It won't actually do anything anyway as there's a CONNECTED route to 3.0/24.

The switch isn't acting as a router, so stop worrying about it. It's passing traffic from the two vlans to the ASA (and other appropriate ports.)

The core problem is with the ASA. It's a firewall, not a router. (direct quote from Cisco) It has to be configured to allow traffic to flow between the two same-security-level interfaces. (turn on both.)

pix-515e(config)# same-security-traffic permit ?

configure mode commands/options:
  inter-interface  Permit communication between different interfaces with the same security level 
  intra-interface  Permit communication between peers connected to the same interface
Improve this answer
4
  • Ricky thanks, I turned both on as requested but still unable to ping 192.168.2.1 from vlan200 (3.5 on the sw) \ I am rethinking how I want to do this and what I am going to do is allow the wired and corporate wireless users to use the 192.168.2.1/24 network and then use the 192.168.3.1/24 as the GUEST network that will not be able to talk to vlan 100. With my current setup do you think this will work properly?
    – tf09
    Nov 26, 2018 at 21:07
  • STOP doing things from the switch. Use real computers.
    – Ricky
    Nov 26, 2018 at 21:13
  • hah okay noted...so from the ASA side should I just lower the security level to 50 if I want this GUEST network to not be able to communicate with the wired/corp network 2.1? -- I also cannot do real computers as I am setting this up at my desk to be shipped down so I was trying to make this a clean plug and play as possible
    – tf09
    Nov 26, 2018 at 21:16
  • Ricky - statically assigned my PC a 192.168.2.20 connected into the switches and tried to ping the gateway of the WIFI network that is setup as a sub-interfface on the ASA 192.168.3.1 and did not work. I enabled same security as reccomended. I also messed around with the switchport holding my laptop from making it a trunk to assigning it a trunk native vlan 100 still no go. Anything you can think of that I am missing?
    – tf09
    Dec 14, 2018 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.