topic Re: Cannot Upload files between Vlan +ASA Firewall in Routing and SD-WAN

Cannot Upload files between Vlan +ASA Firewall

Manojy — Wed, 20 Dec 2023 11:36:53 GMT

Hello,

We have set up separate VLANs for phones and data, with the phone VLAN2 and Data on a native VLAN. I am able to access the phones and UCM IPPBX GUI from the native VLAN, which is on my 192.168.0.0 subnet, to the voice VLAN, which is on the 192.168.70.0 subnet.

Before separating the VLANs, I was able to upload firmware on our IP phones, but after isolating the voice VLAN, I am unable to do so. We have an ASA firewall with two interfaces, one on the 192.168.0.0 and the second one for voice on the 192.168.70.0 subnet. The security levels are the same, and I am able to ping and access the GUI of phones and IPPBX.

Are there any extra commands that I need to add to enable traffic from one subnet to another for uploading the firmware?

Snapshot of the Phone and uploading path attached.

Please assist and advise.

Re: Cannot Upload files between Vlan +ASA Firewall

myabrownn876 — Wed, 20 Dec 2023 11:53:33 GMT

To enable firmware uploads from your native VLAN to the voice VLAN, consider checking the ASA firewall rules. Ensure that traffic is allowed between the subnets 192.168.0.0 and 192.168.70.0 specifically for the port used during firmware uploads.

If the firewall settings are confirmed, you might also want to verify any network ACLs or VLAN access restrictions that could be affecting the firmware upload path.

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Wed, 20 Dec 2023 14:04:46 GMT

There are currently no restrictions set between the two subnets, but the only restriction is that NAT is not allowed for IP phones outside the network. The UCM uses port 8090, however, it is currently not possible to see the HTTP port for the Grandstream phones via web browser. The acl is also applied from any to any.I have reached out to the help desk team to inquire if there are any available ports. I am waiting for their response.

Re: Cannot Upload files between Vlan +ASA Firewall

paul driver — Wed, 20 Dec 2023 14:40:49 GMT

Hello
where is the source of the http connection originating from - internal or external

can you post the run cfg of the asa?
I assume this is the same topology from your last OP correct!

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Wed, 27 Dec 2023 10:37:18 GMT

where is the source of the http connection originating from - Internal

can you post the run cfg of the asa? sure will do
I assume this is the same topology from your last OP correct! yes

i am trying to upgrade the firmware of the phones from my pc which is on 192.168.0.0 subnet.i am able to access the phones GUI from my pc and when i click upload the firmware located at my computer folder nothing happens..but before isolating the vlan for voice i was able to do that because vlan was not in the picture.

Native Vlan 192.168.0.0  Voice Vlan 192.168.70.0

Regards

Manoj

Re: Cannot Upload files between Vlan +ASA Firewall

MHM Cisco World — Wed, 20 Dec 2023 17:12:51 GMT

Hi friend again
so you have success ping but the HTTP is not allow ?
MHM

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Wed, 20 Dec 2023 17:44:16 GMT

Pls find asa Config as you requested

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Wed, 20 Dec 2023 17:46:47 GMT

Yes i ahve success ping from ASA and ping from inside subnet to Voice Vlan

I enabled Http server but still same issue.

I have attached my asa config.pls find below.

Re: Cannot Upload files between Vlan +ASA Firewall

MHM Cisco World — Wed, 20 Dec 2023 18:08:01 GMT

you apply access list (only allow ICMP) to direction IN to both Inside and IPPhone interface,
this ACL will override same secuirty level permit intra/inter interface
so you need to allow HTTP to make client can access server.
or try permit ip any any first to check if ACL is source of issue

MHM

Re: Cannot Upload files between Vlan +ASA Firewall

MHM Cisco World — Wed, 27 Dec 2023 10:40:32 GMT

ASA# packet-tracer input ipphone tcp <ip of ipphone host>1025 (ip of inside server) 443 detailed

Share output of above

MHM

Re: Cannot Upload files between Vlan +ASA Firewall

paul driver — Wed, 27 Dec 2023 10:42:51 GMT

Hello
TBH - I dont see anything that stands out on the ASA negating http access between vlans, can you run a PT and share the results please.

ASA

packet-tracer input inside tcp 192.168.0.x http 192.168.70.x http

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Thu, 21 Dec 2023 04:21:32 GMT

Hi,

Please find attached the inputs from the packet tracer.

Regards

Manoj

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Thu, 21 Dec 2023 04:23:00 GMT

Hello,

Please find attached the input from the packet tracer.

Regards

Manoj

Re: Cannot Upload files between Vlan +ASA Firewall

MHM Cisco World — Thu, 21 Dec 2023 08:42:14 GMT

ASA# capture capin interface inside match ip host <server IP>
Asa#show capture 
Connect to server and wait then
Asa#no capture capin

Share results here

MHM

Re: Cannot Upload files between Vlan +ASA Firewall

paul driver — Thu, 21 Dec 2023 10:16:55 GMT

Hello
I dont see anything from that PT negating access on the FW , The only thing I can think of is both local http server and client need to be in the same LAN ( a bespoke requirement for this type of process) hence why it worked before you created the additional LAN and relocated the phones.

I would suggest check the manufacturer guidelines for local firmware upgrades

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Thu, 21 Dec 2023 10:31:19 GMT

Hello,

Yes before separating the LAN it was connected to the same switch and native VLAN by default but the IP of the interface remained separate and the uploading of firmware worked without issues. After isolating the network keeping data on native vlan and voice vlan2, i am not able to upload and apply firmware through GUI anymore.

The firmware can be done through network using TFTP and i have not used it.

I will ask the manufacturer guidelines.

Regards

Manoj

Re: Cannot Upload files between Vlan +ASA Firewall

MHM Cisco World — Thu, 21 Dec 2023 10:36:54 GMT

As I mention for previous your post,
I need to see the topology
MHM

Re: Cannot Upload files between Vlan +ASA Firewall

paul driver — Thu, 21 Dec 2023 11:27:59 GMT

Hello @Manojy
I have since managed to check for you, it does indeed suggest local upgrade needs to be LAN specific - please se below.. page 5 ( also a screen snippet attached)

https://www.grandstream.com/hubfs/Product_Documentation/Firmware_Upgrade_Guide.pdf

Re: Cannot Upload files between Vlan +ASA Firewall

Manojy — Thu, 21 Dec 2023 12:27:42 GMT

Hello Paul,

Thankyou for your time and assistance.Highly Appreciated.

My question remains the same if i can browse the GUI of phone and i get the file path from my inside subnet where the phone can see the folder but it cannot upload and my asa has no restriction in such situation what will be the solution ?

I was looking if without hooking out the phone just browse and upload the firmware.

Brainstorming.

Thanks in advance.

Re: Cannot Upload files between Vlan +ASA Firewall

paul driver — Thu, 21 Dec 2023 15:06:50 GMT

Hello
as a work around you could put the pc that’s the http server in the same vlan as the ip phones