3

We're in the middle of moving to a more secure system, and the first step is to add this security appliance. Currently in place are two small quasi home-grade Cisco routers (rv260W and rv130). This device is meant to take over all their responsibilities for the mean time until we buy a more proper routing device.

I've replicated the setup from the two routers to the best of my ability in the ASA, set the VLANs to the same security level, and did my best to add routes between them. Packet traces work as expected, but actual pings and http requests between the two VLANs time out. I had some success by setting the primary DNS on my two test machines to their respective gateways, but it feels like that's hacky, and I'd rather do it right.

It wouldn't really matter if cross talk happened, except for the PBX that lives on the VOIP network, we need to be able to see it.

Current config (some parts removed for security):

ASA Version 9.8(2)
!
hostname x
enable password x
names

!
interface GigabitEthernet1/1
 nameif outside
 security-level 0
 ip address x 255.255.255.252
!
interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.0.254 255.255.254.0
!
interface GigabitEthernet1/3
 nameif VOIP
 security-level 100
 ip address 172.16.0.99 255.255.255.0
!
interface Management1/1
 management-only
 no nameif
 no security-level
 no ip address
!
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
 subnet 0.0.0.0 0.0.0.0
object network inside
 subnet 192.168.0.0 255.255.254.0
object network phones
 subnet 172.16.0.0 255.255.255.0
object network obj_any_voip
 subnet 0.0.0.0 0.0.0.0
object-group protocol TCPUDP
 protocol-object udp
 protocol-object tcp
access-list internal extended permit ip any any
access-list internal extended permit icmp any any
access-list external extended permit ip any any
access-list external extended permit icmp any any
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu VOIP 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
!
object network obj_any
 nat (inside,outside) dynamic interface
object network obj_any_voip
 nat (VOIP,outside) dynamic interface
!
nat (inside,outside) after-auto source dynamic any interface
access-group internal in interface outside
access-group external in interface inside
access-group internal in interface VOIP
access-group global_access global
route outside 0.0.0.0 0.0.0.0 xx.xxx.xxx.xxx 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication login-history
http server enable
http 192.168.0.0 255.255.254.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

dhcpd auto_config outside
!
dhcpd address 192.168.1.2-192.168.1.249 inside
dhcpd dns 192.168.0.254 interface inside
dhcpd lease 86400 interface inside
dhcpd domain BII interface inside
dhcpd enable inside
!
dhcpd address 172.16.0.120-172.16.0.219 VOIP
dhcpd dns 172.16.0.99 interface VOIP
dhcpd lease 86400 interface VOIP
dhcpd domain voip interface VOIP
dhcpd enable VOIP
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
 parameters
  message-length maximum client auto
  message-length maximum 512
  no tcp-inspection
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
Cryptochecksum: xxx

I'm really new to Cisco stuff (first IT gig), so any suggestions are welcome.

 ciscoasa(config)# ping tcp 172.16.0.54 1
 Type escape sequence to abort.
 No source specified. Pinging from identity interface.
 Sending 5 TCP SYN requests to 172.16.0.54 port 1
 from 172.16.0.99, timeout is 2 seconds:
 RRRRR
 Success rate is 0 percent (0/5)

ciscoasa(config)# ping tcp 192.168.0.21 7
Type escape sequence to abort.
No source specified. Pinging from identity interface.
Sending 5 TCP SYN requests to 192.168.0.21 port 7
from 192.168.0.254, timeout is 2 seconds:
?????
Success rate is 0 percent (0/5)
  • You can try a TCP-based ping to see if the port is reachable/listening on a destination host. ping tcp <destination host> <port>. There are some parts in your config that we can clean up but they shouldn't be causing your problem. Can you provide the output of a packet-tracer attempt to help us see what you're attempting to reach from where? – Jesse P. Apr 16 at 3:59
  • Also, please explain why you're using zones on your inside interfaces. Are you expecting asymmetric routing internally? Usually zoning would be done on your outside interfaces, to account for incoming traffic coming from a different provider than it originally left on (asymmetric routing) which would normally be dropped due to a mismatch of interfaces in the connection table. – Jesse P. Apr 16 at 4:08
  • To be honest, the zones were an attempt to get them talking, I can remove them. TP ping on port 7 to either of the test boxes from the router failed, though it gave RRRRR to the VOIP interface and ????? to the inside interface. – Andy Foster Apr 16 at 11:57
  • You need to try a port that's listening on the destination host. So, if it's a web-server you can try port 80 or 443. For example, ping tcp 192.168.1.1 80. I'd remove the zones because they're not needed. Can you edit your post to provide the packet-tracer output so we can see what all happens? – Jesse P. Apr 16 at 12:14
  • Also, you have a mismatch on your subnet masks between your inside interface and the object you're using to reference it in your NAT. Your object called "inside" says it's a /16 but your interface says it's a /23. Depending on which is valid, you could be creating an asynchronous route. – Jesse P. Apr 16 at 12:26
2

Removing the zones fixed your asynchronous routing issue (the primary cause). This is to clean up the rest of your config so it's a little better defined in certain places.

interface GigabitEthernet1/2
 nameif inside
 security-level 100
 ip address 192.168.0.254 255.255.254.0

I know you corrected your masks in all places but I want to be sure that you intend for your ASA to be 192.168.0.254, even though a mask of 255.255.254.0 gives you 192.168.0.0-192.168.1.255. It just seems odd to have your ASA interface literally in the middle of that range, rather than the first or last host IP address (192.168.0.1 or 192.168.1.254). With it being 192.168.0.254, it suggests to me that you may have intended for the mask to actually be /24 (255.255.255.0).

object network obj_any
 subnet 0.0.0.0 0.0.0.0

object network obj_any
 nat (inside,outside) dynamic interface

This is a default object entry and NAT that all ASAs come with, and should be removed because it's overly broad and creates a security concern as well as possibly causing NAT issues. You should remove these. You already have better-defined objects but you're missing better NAT definitions, so these are just adding confusion to the mix. Please issue the commands:

no object network obj_any
no object network obj_any_voip
!
object network inside
 nat (inside,outside) dynamic interface
!
object network phones
 nat (VOIP,outside) dynamic interface

This next NAT is your "catch all" statement, and isn't doing anything since you are already encompassing your only networks within the other NAT statements. You can choose to leave it anyway, or remove it to make your config cleaner.

If you choose to keep it, I would at least add another "catch all" for your VOIP interface as such:

nat (VOIP,outside) after-auto source dynamic any interface

If you choose to remove it, you can use the command:

no nat (inside,outside) after-auto source dynamic any interface

You have a global access-list referenced but you don't actually have the access-list (global_access) defined, so it's not doing anything. You can remove it by issuing the command:

no access-group global_access global

You have your ASA interface IP addresses referenced as DNS servers in your DHCP daemon settings but ASAs cannot function as DNS servers - only as a client - so you will need to use alternate DNS servers for your DHCP daemon. Please issue the commands:

no dhcpd dns 192.168.0.254 interface inside
no dhcpd dns 172.16.0.99 interface VOIP
!
dhcpd dns <valid DNS server> interface inside
dhcpd dns <valid DNS server> interface VOIP

That's all I can see, to clean up, for now. Let me know if you have any more problems/questions.

  • 1
    Thank you for all your help! I changed everything except the inside gateway location. It's an artifact of when we were /24. We've grown a bunch, and there are many devices that'd have to change to make it work if I changed it. Not to say I never will, just not going to do that as part of this change. – Andy Foster Apr 16 at 13:59
  • That makes sense, then. Glad I could be helpful. Good luck with the rest of your tasks and thanks for the points. – Jesse P. Apr 16 at 14:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.