topic PC not getting IP in transparent ASA in Network Security

PC not getting IP in transparent ASA

mahesh18 — Tue, 12 Mar 2019 01:52:17 GMT

Hi everyone,

ASA 505 is connected to layer 3 switch.

ASA is in transparent mode.

Layer 3 switch has SVI Vlan 20 and also it has dhcp server for vlan 20.

PC connected to transparent switch is not able to get the IP address from layer switch.

I have config the ACL on outside interface of ASA to allow the DHCP reply coming from Switch.

When i assign static IP to PC connected to port eth0/1 of ASA it works fine.

ciscoasa# sh run

: Saved

ASA Version 9.1(1)

firewall transparent

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

xlate per-session deny tcp any4 any4

xlate per-session deny tcp any4 any6

xlate per-session deny tcp any6 any4

xlate per-session deny tcp any6 any6

xlate per-session deny udp any4 any4 eq domain

xlate per-session deny udp any4 any6 eq domain

xlate per-session deny udp any6 any4 eq domain

xlate per-session deny udp any6 any6 eq domain

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 20

interface Ethernet0/1

switchport access vlan 13

interface Ethernet0/2

shutdown

interface Ethernet0/3

shutdown

interface Ethernet0/4

shutdown

interface Ethernet0/5

shutdown

interface Ethernet0/6

shutdown

interface Ethernet0/7

shutdown

interface Vlan1

no nameif

no security-level

interface Vlan13

nameif inside

bridge-group 1

security-level 100

interface Vlan20

nameif Outside

bridge-group 1

security-level 0

interface BVI1

ip address 192.168.20.59 255.255.255.0

boot system disk0:/asa911-k8.bin

ftp mode passive

object network Broadcast

host 255.255.255.255

object network Dhcp-Server

host 192.168.20.3

access-list inside_access_in extended permit ip any any

access-list Outside_access_in extended permit udp object Dhcp-Server object Broa

dcast eq bootpc log

access-list inside_access_in_1 extended permit ip any any

pager lines 24

mtu Outside 1500

mtu inside 1500

no failover

icmp unreachable rate-limit 1 burst-size 1

asdm image disk0:/asdm-712.bin

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

access-group Outside_access_in in interface Outside

access-group inside_access_in_1 in interface inside

route Outside 0.0.0.0 0.0.0.0 192.168.20.3 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 0.0.0.0 0.0.0.0 Outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association pmtu-aging infinite

crypto ca trustpool policy

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 Outside

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 2

Cryptochecksum:cbcb87f40ea45d3bd0b6376e92b5fe8a

: end

ciscoasa# $

ciscoasa#

Thanks

mahesh

Message was edited by: mahesh parmar

PC not getting IP in transparent ASA

Jouni Forss — Sun, 02 Jun 2013 16:37:42 GMT

Hi,

Try these changes

interface Vlan20

security-level 100

same-security-traffic permit inter-interface

access-list OUTSIDE-IN permit icmp host any echo

access-list OUTSIDE-IN permit udp any host 255.255.255.255 eq bootpc

access-list OUTSIDE-IN permit udp host 192.168.20.0 255.255.255.0 eq bootpc

no access-group Outside_access_in in interface Outside

access-group OUTSIDE-IN in interface outside

- Jouni

Re: PC not getting IP in transparent ASA

mahesh18 — Sun, 02 Jun 2013 17:18:31 GMT

Hi Jouni,

It worked great as always.

I got this ASA Security plus license few days back so trying to learn some concepts in home lab.

Need to undertsand the reason for these 2 ACL

1>access-list OUTSIDE-IN permit icmp host any echo

i already have ICMP under global policy so why we use the above ACL?

Also this ACL has hit counts to 0

2>when we allowed ACL to allow BootPC reply from any host to broadcast address then we we need this second ACL?

access-list OUTSIDE-IN permit udp host 192.168.20.0 255.255.255.0 eq bootpc

This ACL has also hit count to 0

Thanks

mahesh

Message was edited by: mahesh parmar

PC not getting IP in transparent ASA

Jouni Forss — Sun, 02 Jun 2013 17:31:24 GMT

Hi,

Even though the "inspect icmp" is configured on the ASA it still doesnt mean that you dont need ACLs to allow the initial ICMP messages. If we have an ACL on the "outside" interface and have not allowed ICMP then it naturally would get blocked by the ACL even though we had "inspect icmp" allowed.

The DHCP server might use ICMP so we allow it from the direction of the DHCP server.

The other ACL line allows DHCP ACK messages to get through from the DHCP server to the Client PC (which address might be something from the 192.168.20.0/24 network)

- Jouni

PC not getting IP in transparent ASA

mahesh18 — Sun, 02 Jun 2013 18:48:47 GMT

Hi Jouni,

i tested this

i removed the ACL

1>access-list OUTSIDE-IN permit icmp host any echo

Rebooted the ASA and PC.

PC gets the IP from the switch and its works fine.

Regards

MAhesh