topic Allowing Traffick Between vlans on ASA5505 in Network Security

Allowing Traffick Between vlans on ASA5505

Roberto Kippins — Tue, 12 Mar 2019 02:08:20 GMT

I have a Cisco ASA5505 configured with 3 vlans outside = x.x.x.x \24, inside = 10.217.46.1 \ 27, and wifi = 10.217.46.33 \ 27. I have security plus liscense but i cant access anything in the inside if im on wifi or i cant access anything from wifi if im on inside cant even ping between vlans but access to the internet is working just fine on both sides any ideas.

Allowing Traffick Between vlans on ASA5505

Eddy Duran — Sun, 07 Jul 2013 18:46:18 GMT

Hello Robert,

What is the security level between interfaces? Would you mind sharing your configuration?

-Eddy Duran

Allowing Traffick Between vlans on ASA5505

Jouni Forss — Sun, 07 Jul 2013 18:48:18 GMT

Hi,

The easiest way to solve this would naturally to see the configuration.

The main things that might affect on the firewall side are

Missing interface ACL
Missing some NAT configuration (depending on software level of the ASA)
The interface "security-level" are set to identical which would block traffic between these interfaces if you DONT have "same-security-traffic permit inter-interface"

You can also take the "packet-tracer" output if you want to test the firewall configurations/rules

packet-tracer input inside tcp

packet-tracer input wifi tcp

One common problen with ICMP through the firewall is missing ICMP Inspection

It can be added with

fixup protocol imcp

fixup protocol icmp error

Or alternatively by entering

policy-map global_policy

class inspection_default

inspect icmp error

inspect icmp

- Jouni

Allowing Traffick Between vlans on ASA5505

Roberto Kippins — Sun, 07 Jul 2013 18:48:23 GMT

they are both at 100

Allowing Traffick Between vlans on ASA5505

Jouni Forss — Sun, 07 Jul 2013 18:49:02 GMT

Hi,

You need to add "same-security-traffic permit inter-interface" atleast

- Jouni