Cisco ASA 5508x, VLANs can't communicate

Question

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This device is meant to take over all their responsibilities for the mean time until we buy a more proper routing device.

I've replicated the setup from the two routers to the best of my ability in the ASA, set the VLANs to the same security level, and did my best to add routes between them. Packet traces work as expected, but actual pings and http requests between the two VLANs time out. I had some success by setting the primary DNS on my two test machines to their respective gateways, but it feels like that's hacky, and I'd rather do it right.

It wouldn't really matter if cross talk happened, except for the PBX that lives on the VOIP network, we need to be able to see it.

Current config (some parts removed for security):

ASA Version 9.8(2)
!
hostname x
enable password x
names

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address x 255.255.255.252
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.0.254 255.255.254.0
!
interface GigabitEthernet1/3
 nameif VOIP
 security-level 100
 ip address 172.16.0.99 255.255.255.0
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network inside
 subnet 192.168.0.0 255.255.254.0
object network phones
 subnet 172.16.0.0 255.255.255.0
object network obj_any_voip
 subnet 0.0.0.0 0.0.0.0
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list internal extended permit ip any any
access-list internal extended permit icmp any any
access-list external extended permit ip any any
access-list external extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu VOIP 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
 nat (inside,outside) dynamic interface
object network obj_any_voip
 nat (VOIP,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group internal in interface outside
access-group external in interface inside
access-group internal in interface VOIP
access-group global_access global
route outside 0.0.0.0 0.0.0.0 xx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.0.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.249 inside
dhcpd dns 192.168.0.254 interface inside
dhcpd lease 86400 interface inside
dhcpd domain BII interface inside
dhcpd enable inside
!
dhcpd address 172.16.0.120-172.16.0.219 VOIP
dhcpd dns 172.16.0.99 interface VOIP
dhcpd lease 86400 interface VOIP
dhcpd domain voip interface VOIP
dhcpd enable VOIP
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum: xxx

I'm really new to Cisco stuff (first IT gig), so any suggestions are welcome.

 ciscoasa(config)# ping tcp 172.16.0.54 1
 Type escape sequence to abort.
 No source specified. Pinging from identity interface.
 Sending 5 TCP SYN requests to 172.16.0.54 port 1
 from 172.16.0.99, timeout is 2 seconds:
 RRRRR
 Success rate is 0 percent (0/5)

ciscoasa(config)# ping tcp 192.168.0.21 7
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 192.168.0.21 port 7
from 192.168.0.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)

Answer 1

Removing the zones fixed your asynchronous routing issue (the primary cause). This is to clean up the rest of your config so it's a little better defined in certain places.

interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.0.254 255.255.254.0

I know you corrected your masks in all places but I want to be sure that you intend for your ASA to be 192.168.0.254, even though a mask of 255.255.254.0 gives you 192.168.0.0-192.168.1.255. It just seems odd to have your ASA interface literally in the middle of that range, rather than the first or last host IP address (192.168.0.1 or 192.168.1.254). With it being 192.168.0.254, it suggests to me that you may have intended for the mask to actually be /24 (255.255.255.0).

object network obj_any
 subnet 0.0.0.0 0.0.0.0

object network obj_any
 nat (inside,outside) dynamic interface

This is a default object entry and NAT that all ASAs come with, and should be removed because it's overly broad and creates a security concern as well as possibly causing NAT issues. You should remove these. You already have better-defined objects but you're missing better NAT definitions, so these are just adding confusion to the mix. Please issue the commands:

no object network obj_any
no object network obj_any_voip
!
object network inside
 nat (inside,outside) dynamic interface
!
object network phones
 nat (VOIP,outside) dynamic interface

This next NAT is your "catch all" statement, and isn't doing anything since you are already encompassing your only networks within the other NAT statements. You can choose to leave it anyway, or remove it to make your config cleaner.

If you choose to keep it, I would at least add another "catch all" for your VOIP interface as such:

nat (VOIP,outside) after-auto source dynamic any interface

If you choose to remove it, you can use the command:

no nat (inside,outside) after-auto source dynamic any interface

You have a global access-list referenced but you don't actually have the access-list (global_access) defined, so it's not doing anything. You can remove it by issuing the command:

no access-group global_access global

You have your ASA interface IP addresses referenced as DNS servers in your DHCP daemon settings but ASAs cannot function as DNS servers - only as a client - so you will need to use alternate DNS servers for your DHCP daemon. Please issue the commands:

no dhcpd dns 192.168.0.254 interface inside
no dhcpd dns 172.16.0.99 interface VOIP
!
dhcpd dns <valid DNS server> interface inside
dhcpd dns <valid DNS server> interface VOIP

That's all I can see, to clean up, for now. Let me know if you have any more problems/questions.