topic Hi,You can use a similar in Network Security

asa 8.3 - routing /nat 0 multiple lan

Paolo Piutz — Tue, 12 Mar 2019 05:42:28 GMT

Hi,

I've an asa 5510 with 8.3

I created a trunk with some vlan

eth0/0.10 ip address: 172.16.10.1 /24

eth0/0.11 ip address: 172.16.11.1 /24

eth0/0.12 ip address: 172.16.12.1 /24

eth0/0.13 ecc ecc ecc

eth0/0.14

ecc ecc ecc

Evey vlan have security level 50 and wan 0

How can I set nat0/routing between the lan?

I link a switch with the same vlan configured and from some LAN I can ping other LAN . Not all LAN can ping all LAN ...

es: from 172.16.10.1 /24 I can ping 172.16.11.1 /24, but from 172.16.12.1 /24 I cannot ping 172.16.13.1 /24

I configured all LAN in the same manner: all LAN can go in internet and all LAN can be accessed from VPN

I don't understand why for ex. LAN1 can ping LAN2 but LAN4 cannot ping LAN5: there are not rules!!!!

With packet tracert I see that the traffic is permitted....

Paolo

Hi,There seems to be some

Vibhor Amrodia — Fri, 27 Mar 2015 12:59:07 GMT

Hi,

There seems to be some confusion in terms of which traffic is working and which is not.

Can you list this information:-

show ip and tell us which direction is the traffic not working.

Thanks and Regards,

Vibhor Amrodia

Have you ensured that ICMP is

Marius Gunnerud — Sat, 28 Mar 2015 21:09:03 GMT

Have you ensured that ICMP is permitted in any software firewall installed on the test PCs?

Since you say that you do not have any ACLs configured on the interfaces, I assume you have configured same-security-traffic permit intra-interface and same-security-traffic permit inter-interface commands?

Have you run the packet tracer in both directions? from Lan 4 to Lan 5 and then again from Lan 5 to Lan 4?

Please remember to select a correct answer and rate helpful posts

Hi to allthanks for reply

Paolo Piutz — Wed, 08 Apr 2015 16:43:39 GMT

Hi to all

thanks for reply.

same-security-traffic permit intra-interface and same-security-traffic permit inter-interface in already configured.

All net have the same security-level.

but....

seem that the networks that are interesting can comminicate each other...

I have another question now:

a server from a network have to communicate on tcp port 1433 with a server on another net with the same security-level, but cannot. I can ping the network.

I think that I have to config a inspect with policy-map, ecc but there is not the protocol.

How I can do to open port 1433.

Thanks.

Paolo.

Hi,You can use a similar

Vibhor Amrodia — Fri, 10 Apr 2015 02:30:12 GMT

Hi,

You can use a similar configuration as this:-

https://supportforums.cisco.com/discussion/11519281/asa-5520-and-inspection-mssql-dynamic-port

Thanks and Regards,

Vibhor Amrodia