topic Re: Unable to access asa interface from the vlan present in the router in Network Security

Unable to access asa interface from the vlan present in the router

gautamgadeela — Sat, 29 Apr 2023 16:22:57 GMT

Hi everyone,

I'm unable to access the interface of cisco asa from a vlan which is present on the router connected below. Packet-tracer shows no route to host.

Re: Unable to access asa interface from the vlan present in the router

gautamgadeela — Sat, 29 Apr 2023 16:23:30 GMT

Can anyone guide me why it says no route to host?

Re: Unable to access asa interface from the vlan present in the router

MHM Cisco World — Sat, 29 Apr 2023 16:28:42 GMT

The asa not support equal cost path'

So you need to make only one link between asa and router

Re: Unable to access asa interface from the vlan present in the router

gautamgadeela — Sat, 29 Apr 2023 16:31:47 GMT

I'm doing redundant interfaces on asa it should be okay right ?

Re: Unable to access asa interface from the vlan present in the router

MHM Cisco World — Sat, 29 Apr 2023 16:40:13 GMT

No asa can drop asymmetric traffic' remove one link' keep sure asa have route toward router for vlan subnet and check again

Re: Unable to access asa interface from the vlan present in the router

Rob Ingram — Sat, 29 Apr 2023 16:55:32 GMT

ASA supports equal cost routes since version 9.3 using traffic zones - https://www.cisco.com/c/en/us/td/docs/security/asa/asa916/configuration/general/asa-916-general-config/interface-zones.html

Re: Unable to access asa interface from the vlan present in the router

MHM Cisco World — Sat, 29 Apr 2023 16:57:39 GMT

I know that but he have lab and his asa not support zone.

Re: Unable to access asa interface from the vlan present in the router

Rob Ingram — Sat, 29 Apr 2023 17:13:20 GMT

I see no information in this post why this lab cannot support traffic zones, but that won't be related to this issue.

@gautamgadeela don't run packet-tracer to the IP address of the isp1 interface IP address (192.168.1.2) - change the destination to an IP address behind that interface. The ASA does not support communicating from behind one of its interfaces through the ASA to one of the ASAs own interfaces.

Also when packet-tracer using ICMP usse type 8 and code 0, not 1 1.

Re: Unable to access asa interface from the vlan present in the router

gautamgadeela — Sat, 29 Apr 2023 17:49:38 GMT

Thank you guys I'm able to figure out where i was making a mistake. I ran into issue now where i have created two vlans on R3 as 192,168.1.4 and 2.4 and 1.1 and 2.2 on R2. The link between R2 and R3 is trunk. I'm able to reach 192.168.1.1 from R1 but unable to reach 2.2 on R2 and 1.4 and 2.4 on R3 is there anything i'm overlooking.

Thanks for you help

Re: Unable to access asa interface from the vlan present in the router

MHM Cisco World — Sat, 29 Apr 2023 18:08:47 GMT

You change topology replace router with sw?