Routing between 2 interfaces - Same security level ASA 5506

abccisco2011 — Tue, 12 Mar 2019 07:38:47 GMT

Hello,

I am trying to have 2 interfaces on ASA 5506 to talk to each other and not able to succeed. They have same security level, so they should not need any access list right? Here is the config

hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
names
!
interface GigabitEthernet1/1
nameif outside
security-level 0
ip address dhcp setroute
!
interface GigabitEthernet1/2
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet1/3
nameif voice
security-level 100
ip address 10.1.7.1 255.255.255.0
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit inter-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network inside_nw
subnet 192.168.1.0 255.255.255.0
description inside_nw
object network voice_nw
host 10.1.7.0
description voice_nw
access-list voice_access_in extended permit ip 192.168.1.0 255.255.255.0 10.1.7.0 255.255.255.0
access-list inside_access_in extended permit ip 10.1.7.0 255.255.255.0 object inside_nw
pager lines 24
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu voice 1500
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
!
object network obj_any
nat (any,outside) dynamic interface
access-group inside_access_in in interface inside
access-group voice_access_in in interface voice
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
user-identity default-domain LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
no ssh stricthostkeycheck
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
username fwadmina password 9KI89.52eSQ4gKA4 encrypted privilege 15
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous prompt 1

Can anyone tell me what needs to be done?

Thanks in advance

Given that you have "same

Marvin Rhoads — Thu, 21 Apr 2016 03:27:14 GMT

Given that you have "same-security-traffic permit inter-interface" yes hosts on those networks should be able to communicated with each other.

The interfaces themselves cannot as one interface IP address cannot connect to (or even ping) another interface on the same ASA.

Note your inside_access_in and voice_access_in ACLs will implicitly deny all other traffic - even outbound - since once you apply an ACL to an interface anything not specifically allowed is denied. I would remove those ACLs as they are not necessary.

The other thing is that hosts on the two internal networks need to use the ASA as the gateway for the respective other network.

Thanks Marvin for your help.

abccisco2011 — Thu, 21 Apr 2016 14:40:02 GMT

Thanks Marvin for your help. I removed the access list and its worked. As this firewall is not connected to the intrenet that's there is no gateway and 2 networks are directly connected so no need to have a gateway for them, right?

Thanks,

Sushant

@abccisco2011 ,

Marvin Rhoads — Fri, 22 Apr 2016 00:25:19 GMT

abccisco2011 ,

You're welcome.

The hosts on a given network still need to use the ASA as their gateway so as to know which device (the ASA) provides off-local-net connectivity - even if it is just to other internal networks.,

topic Thanks Marvin for your help. in Network Security

Routing between 2 interfaces - Same security level ASA 5506

Given that you have "same

Thanks Marvin for your help.

@abccisco2011 ,