topic Re: ASA5508 cant see block traffic between router subinterfaces in Network Security

ASA5508 cant see block traffic between router subinterfaces

ErrolCash0963 — Tue, 24 Sep 2019 16:40:38 GMT

Good Day,

Im currently having an issue where i have my sub interfaces configurated on my router. I also have an ASA5508 that i am using to control traffic. The asa can block traffic between the outside(isp) and inside(internal vlans) with no problem. But if i setup an acl to block traffic between the internal vlans it does not work.

I do not even see the traffic flow between the vlans(server vlan to users vlan) in the asa syslogs.

Can i get some help with this please?

Also my current setup is: my isp is plugged into an interface on the asa, my asa is plugged into an interface on the router and my router is plugged into a trunk port on my switch.

Re: ASA5508 cant see block traffic between router subinterfaces

balaji.bandi — Tue, 24 Sep 2019 16:46:46 GMT

VLAN you like to block intervlan blocking, are these interface configured IP address in the FW ? and Devices pointed GW as FW ?

if not FW will not aware of that traffic to block.

Re: ASA5508 cant see block traffic between router subinterfaces

ErrolCash0963 — Tue, 24 Sep 2019 17:07:43 GMT

Currently i have the ip address ranges setup as network objects in the FW and i only have the router default gateway set to the FW.

Do my router subinterfaces need to be setup in the FW as interfaces as well?

Re: ASA5508 cant see block traffic between router subinterfaces

balaji.bandi — Tue, 24 Sep 2019 20:07:39 GMT

If your device has GW setup in the router, the packet will not reach FW for you to work.

Do you high-level diagram to understand where your FW and how the router setup, where is users IP / Vlan like to block?

Re: ASA5508 cant see block traffic between router subinterfaces

ErrolCash0963 — Tue, 24 Sep 2019 20:21:00 GMT

Please see a high level diagram. My vlans/sub interfaces are setup on the router. There a link going from the router to the follow firewall.

Re: ASA5508 cant see block traffic between router subinterfaces

balaji.bandi — Tue, 24 Sep 2019 23:38:29 GMT

the solution you looking may not work.

Re: ASA5508 cant see block traffic between router subinterfaces

bhargavdesai — Wed, 25 Sep 2019 07:49:27 GMT

As you are terminating your Hosts and Servers pointing towards a ROUTER ( Router on a stick configuration ) as a Default Gateway. The traffic between Host VLAN and Server VLAN never hit the ASA, hence ASA can not take action and stop. There are few ways you can control the traffic between HOST and Server VLANs.

You can configure ACLs on the ROUTER (Router on a stick).

You can change the configuration and setup and make ASA as a default Gateway for HOSTs and Servers and than apply ACLs on ASA.

HTH

### RATE ALL HELPFUL RESPONSES ###