Multiple VLAN Connectivity - ASA 5516

abccisco2011 — Tue, 12 Mar 2019 07:42:27 GMT

I have an ASA 5516 and a Catalyst 2960 X. I have created 2 sub interfaces

192.168.11.0/24 and 192.168.12.0/24 on interfaces gi 1/1.11 and gi 1/1.12.

I have a cisco 2960 x switch connected to gi 1/1 interface of the firewall. I connected one laptop in VLAN 11 and able to ping 192.168.11.1 but not 192.168.12.1. Can you tell me what is wrong in the config?

ASA 5516

:
: Serial Number: JAD2011073R
: Hardware: ASA5516, 8192 MB RAM, CPU Atom C2000 series 2416 MHz, 1 CPU (8 cores)
:
ASA Version 9.5(2)
!
hostname PEEQFW01
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
no nameif
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/1.11
vlan 11
nameif inside1
security-level 100
ip address 192.168.11.1 255.255.255.0
!
interface GigabitEthernet1/1.12
vlan 12
nameif inside2
security-level 100
ip address 192.168.12.1 255.255.255.0
!
interface GigabitEthernet1/2
speed 1000
duplex full
nameif outside
security-level 0
ip address 96.82.169.41 255.255.255.248
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
pager lines 24
logging asdm informational
mtu inside1 1500
mtu outside 1500
mtu inside2 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
route outside 0.0.0.0 0.0.0.0 96.82.169.46 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
http server enable
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh 192.168.11.0 255.255.255.0 inside1
ssh 192.168.12.0 255.255.255.0 inside2
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd auto_config inside1
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 2
Cryptochecksum:8333d86dffb7e740302ec1bb1811265f
: end

Catalyst 2960-x

Current configuration : 4167 bytes
!
! Last configuration change at 16:12:53 UTC Wed May 4 2016
! NVRAM config last updated at 16:04:53 UTC Wed May 4 2016
!
version 15.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname PEEQPHONESW01
!
boot-start-marker
boot-end-marker
!
enable password coretw01nw$2016
!
username coreadmina privilege 15 password 0 coretw01nw$2016
aaa new-model
!
!
aaa authentication login default local
!
!
!
!
!
!
aaa session-id common
switch 1 provision ws-c2960x-48fps-l
!
!
ip domain-name abcimaging.com
!
!
!
!
!
!
!
!
spanning-tree mode pvst
spanning-tree extend system-id
!
!
!
!
vlan internal allocation policy ascending
!
!
!
!
!
!
!
!
!
!
!
interface FastEthernet0
no ip address
!
interface GigabitEthernet1/0/1
switchport mode trunk
!
interface GigabitEthernet1/0/2
switchport access vlan 11
!
interface GigabitEthernet1/0/3
switchport access vlan 11
!
interface GigabitEthernet1/0/4
switchport access vlan 11
!
interface GigabitEthernet1/0/5
switchport access vlan 11
!
interface GigabitEthernet1/0/6
switchport access vlan 11
!
interface GigabitEthernet1/0/7
switchport access vlan 11
!
interface GigabitEthernet1/0/8
switchport access vlan 11
!
interface GigabitEthernet1/0/9
switchport access vlan 11
!
interface GigabitEthernet1/0/10
switchport access vlan 11
!
interface GigabitEthernet1/0/11
switchport access vlan 11
!
interface GigabitEthernet1/0/12
switchport access vlan 11
!
interface GigabitEthernet1/0/13
switchport access vlan 11
!
interface GigabitEthernet1/0/14
switchport access vlan 11
!
interface GigabitEthernet1/0/15
switchport access vlan 11
!
interface GigabitEthernet1/0/16
switchport access vlan 11
!
interface GigabitEthernet1/0/17
switchport access vlan 11
!
interface GigabitEthernet1/0/18
switchport access vlan 11
!
interface GigabitEthernet1/0/19
switchport access vlan 11
!
interface GigabitEthernet1/0/20
switchport access vlan 11
!
interface GigabitEthernet1/0/21
switchport access vlan 11
!
interface GigabitEthernet1/0/22
switchport access vlan 11
!
interface GigabitEthernet1/0/23
switchport access vlan 11
!
interface GigabitEthernet1/0/24
switchport access vlan 11
!
interface GigabitEthernet1/0/25
switchport access vlan 12
!
interface GigabitEthernet1/0/26
switchport access vlan 12
!
interface GigabitEthernet1/0/27
switchport access vlan 12
!
interface GigabitEthernet1/0/28
switchport access vlan 12
!
interface GigabitEthernet1/0/29
switchport access vlan 12
!
interface GigabitEthernet1/0/30
switchport access vlan 12
!
interface GigabitEthernet1/0/31
switchport access vlan 12
!
interface GigabitEthernet1/0/32
switchport access vlan 12
!
interface GigabitEthernet1/0/33
switchport access vlan 12
!
interface GigabitEthernet1/0/34
switchport access vlan 12
!
interface GigabitEthernet1/0/35
switchport access vlan 12
!
interface GigabitEthernet1/0/36
switchport access vlan 12
!
interface GigabitEthernet1/0/37
switchport access vlan 12
!
interface GigabitEthernet1/0/38
switchport access vlan 12
!
interface GigabitEthernet1/0/39
switchport access vlan 12
!
interface GigabitEthernet1/0/40
switchport access vlan 12
!
interface GigabitEthernet1/0/41
switchport access vlan 12
!
interface GigabitEthernet1/0/42
switchport access vlan 12
!
interface GigabitEthernet1/0/43
switchport access vlan 12
!
interface GigabitEthernet1/0/44
switchport access vlan 12
!
interface GigabitEthernet1/0/45
switchport access vlan 12
!
interface GigabitEthernet1/0/46
switchport access vlan 12
!
interface GigabitEthernet1/0/47
switchport access vlan 12
!
interface GigabitEthernet1/0/48
switchport access vlan 12
!
interface GigabitEthernet1/0/49
!
interface GigabitEthernet1/0/50
!
interface GigabitEthernet1/0/51
!
interface GigabitEthernet1/0/52
!
interface Vlan1
no ip address
!
interface Vlan11
ip address 192.168.11.2 255.255.255.0
!
interface Vlan12
ip address 192.168.12.2 255.255.255.0
!
ip default-gateway 192.168.11.1
ip http server
ip http secure-server
!
ip ssh time-out 60
ip ssh version 2
!
!
!
!
!
!
line con 0
line vty 1 4
transport input ssh
line vty 5 15
transport input ssh
!
end

Hello;

Maykol Rojas — Wed, 04 May 2016 16:29:33 GMT

Hello;

Nothing, you did nothing wrong. You cannot do that on an ASA firewall. You cannot ping any far-end interface of the firewall, just the IP on the interface that you are, well facing... lol.

Plug a host there and try to ping it... it will work, I guarantee it...

Mike.

Hi,

Rishabh Seth — Wed, 04 May 2016 16:33:38 GMT

Hi,

As per the network requirement description and configuration above, I understand that you have a laptop in connected to vlan11 (ASA ip: 192.168.11.1 255.255.255.0; name:inside) and you are trying to ping other interface which is in vlan12 (ASA ip:192.168.12.1 255.255.255.0 ; name: inside2)

As per ASA design, one cannot ping the far side interface. So you can ping inside interface from a machine in vlan11 and can ping interface vlan12 from a machine behind inside2 interface, but user in vlan11 will not be able to ping vlan12 interface of ASA(inside2 interface) and vice versa.

Hope it answers your query and feel free to correct my understanding of the issue.

Thanks,

Rate the answer if it helps in resolving your query.

Thanks Maykol, it works. I

abccisco2011 — Wed, 04 May 2016 16:50:17 GMT

Thanks Maykol, it works. I will keep this in my mind from the next time.

Sushant

Anytime :).

Maykol Rojas — Wed, 04 May 2016 16:55:42 GMT

Anytime :).

topic Multiple VLAN Connectivity - ASA 5516 in Network Security

Multiple VLAN Connectivity - ASA 5516

Hello;

Hi,

Thanks Maykol, it works. I

Anytime :).