topic Many thanks in Network Security

Unable to ping from directly connected Switch to ASA

mahesh18 — Tue, 12 Mar 2019 04:18:25 GMT

Hi Everyone,

Here is setup below

ASA1-----SW------access port to ----ASA2

ASA1 has vlan 4 IP 192.168.1.171

ASA2 has vlan 4 IP 192.168.1.173.

ASA1 has direct connection to Switch and Switch has direct connection to ASA2.

I can ping from ASA1 to IP 192.168.1.173.

Switch config is below

Switch port connected to ASA1 and ASA2 has config below

switchport mode access

switchport access vlan 4

Switch does not have SVI vlan 4.

From switch i can not ping the IP 192.168.1.171 or 173.

When i config SVI vlan 4 with IP 192.168.1.174 on switch then i can ping IP 192.168.2.171 and .173

Need to know is this default behaviour?

Regards

Mahesh

Hi Mahesh,This is expected

kcnajaf — Sat, 07 Jun 2014 19:50:49 GMT

Hi Mahesh,

This is expected behavior.

When you have SVI for vlan 4 created on the SW and when you initiate a ping, the ping will be sourced with SVI vlan 4 interface. The switch now knows both the source and destination is on same subnet and hence send a arp broadcast to all vlan 4 ports and ASA responds with its MAC address and ping works.

But when you don't have a SVI for vlan 4 on switch, the ping will be sourced with some other ip address (may be the managment interface of switch) and there should be routing enabled in route this packet to different network.

Hope that helps.

Regards

Najaf

Many thanks

mahesh18 — Sat, 07 Jun 2014 20:04:23 GMT

Many thanks Najaf

Regards

Mahesh

Thanks Mahesh for marking

kcnajaf — Sat, 07 Jun 2014 20:16:01 GMT

Thanks Mahesh for marking this as correct answer