We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This device is meant to take over all their responsibilities for the mean time until we buy a more proper routing device.
I've replicated the setup from the two routers to the best of my ability in the ASA, set the VLANs to the same security level, and did my best to add routes between them. Packet traces work as expected, but actual pings and http requests between the two VLANs time out. I had some success by setting the primary DNS on my two test machines to their respective gateways, but it feels like that's hacky, and I'd rather do it right.
It wouldn't really matter if cross talk happened, except for the PBX that lives on the VOIP network, we need to be able to see it.
Current config (some parts removed for security):
ASA Version 9.8(2)
!
hostname x
enable password x
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address x 255.255.255.252
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.0.254 255.255.254.0
!
interface GigabitEthernet1/3
nameif VOIP
security-level 100
ip address 172.16.0.99 255.255.255.0
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside
subnet 192.168.0.0 255.255.254.0
object network phones
subnet 172.16.0.0 255.255.255.0
object network obj_any_voip
subnet 0.0.0.0 0.0.0.0
object-group protocol TCPUDP
protocol-object udp
protocol-object tcp
access-list internal extended permit ip any any
access-list internal extended permit icmp any any
access-list external extended permit ip any any
access-list external extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu VOIP 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
nat (inside,outside) dynamic interface
object network obj_any_voip
nat (VOIP,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group internal in interface outside
access-group external in interface inside
access-group internal in interface VOIP
access-group global_access global
route outside 0.0.0.0 0.0.0.0 xx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.0.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.249 inside
dhcpd dns 192.168.0.254 interface inside
dhcpd lease 86400 interface inside
dhcpd domain BII interface inside
dhcpd enable inside
!
dhcpd address 172.16.0.120-172.16.0.219 VOIP
dhcpd dns 172.16.0.99 interface VOIP
dhcpd lease 86400 interface VOIP
dhcpd domain voip interface VOIP
dhcpd enable VOIP
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum: xxx
I'm really new to Cisco stuff (first IT gig), so any suggestions are welcome.
ciscoasa(config)# ping tcp 172.16.0.54 1
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 172.16.0.54 port 1
from 172.16.0.99, timeout is 2 seconds:
RRRRR
Success rate is 0 percent (0/5)
ciscoasa(config)# ping tcp 192.168.0.21 7
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 192.168.0.21 port 7
from 192.168.0.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
ping tcp <destination host> <port>
. There are some parts in your config that we can clean up but they shouldn't be causing your problem. Can you provide the output of a packet-tracer attempt to help us see what you're attempting to reach from where? – Jesse P. Apr 16 '19 at 3:59ping tcp 192.168.1.1 80
. I'd remove the zones because they're not needed. Can you edit your post to provide the packet-tracer output so we can see what all happens? – Jesse P. Apr 16 '19 at 12:14