topic Different three VRF connectivity on Nexus 7 K with cisco ASA 558 in Network Security

Different three VRF connectivity on Nexus 7 K with cisco ASA 5585

saurabhgoel169 — Tue, 12 Mar 2019 00:49:11 GMT

HI ALL,

I have three different VRF on Nexus 7k, and we want those should be extend to Cisco ASA 5585 IOS 8.4.5...

We had used the trunk port on Nexus 7k to ASA connectivity... and Dynamic protocl OSPF is running , both are in same area of OSPF

We are making subinterface on firewall for each VLAN.... in this scnerio only one VRF connectivity is working.. but other VRF are not pingable from ASA.

Please help me how we can solve this case...

Regards

Saurabh Goel

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

Michal Garcarz — Sat, 19 Jan 2013 13:24:38 GMT

Hi,

So we have trunk (dot1q) between ASA and N7k. On ASA each vlan is terminated on separate subinterface.

On N7k it's one physical interface (trunk) with multiple vlans - and each in separate VRF ?

1. And we have a problems with pings between directly connected devices in the same vlan ?

2. Did you try to capture traffic on ASA to check if it was leaving ASA ?

3. Did you try to capture traffic on N7k to check if it arrived ?

If you could post interface configs of both devices and give example what is not working (src_ip, dst_ip) i could help more.

(and ofcourse reply to my 3 questions)

Michal

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

saurabhgoel169 — Sun, 20 Jan 2013 11:26:57 GMT

Yes dot1 q between the ASA and 7k.

Each VLAN is separetely terminated on ASA with subinterfaces.

Q. On N7k it's one physical interface (trunk) with multiple vlans - and each in separate VRF ?

Ans Yes

Q And we have a problems with pings between directly connected devices in the same vlan ?

Ans Yes directly connnected device are not pinging.

Firewall Interface configuration:

interface Port-channel13

no vlan

no nameif

no security-level

no ip address

interface Port-channel 13.1021

description VRF-X

vlan 1021

nameif inside

security-level 100

ip address x.x.15.5 255.255.255.0

interface Port-channel13.1022
description VRF-Y

vlan 1022
nameif inside
security-level 100
ip address x.x.11.5 255.255.255.0

Switch Interface is Trunk port and all VLANS are allowed in that

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

Michal Garcarz — Sun, 20 Jan 2013 12:29:32 GMT

ASA config is correct.

I suspect that traffic from ASA is landing in incorrect VRF on N7K - and that's why N7K can not respond.

1. Check VRF assigment on N7K.

2. Capture traffic on ASA, try to ping from N7K to ASA, can you see those packets ?

---

Michal

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

saurabhgoel169 — Sun, 20 Jan 2013 12:42:07 GMT

What does the meaning of VRF assignment on 7k and 7K Switch port is trunk port so what does the problem in that?

------

Saurabh

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

Michal Garcarz — Sun, 20 Jan 2013 12:59:54 GMT

ok, show switch: ports (L2) and vlan interfaces (L3) configuration

Michal

Re: Different three VRF connectivity on Nexus 7 K with cisco ASA

etamminga — Sun, 20 Jan 2013 22:21:04 GMT

Hi,

Both interfaces on the ASA are using the same security-level. Doesn't this require one of the sysopts?

hostname(config)# same-security-traffic permit inter-interface

Regards,
Erik

Sent from Cisco Technical Support iPad App

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

r4farooqui — Mon, 21 Jan 2013 01:15:12 GMT

Please check mac-address of your ASA Interfaces and check switch mac-address table too.

Cheers

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

saurabhgoel169 — Mon, 21 Jan 2013 05:04:00 GMT

This command is already in ASA...

Regards

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

saurabhgoel169 — Mon, 21 Jan 2013 05:05:00 GMT

Hi,

Mac address of Firewall interface is not reflecting in switch mac-address table...

Regards

Saurabh Goel

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

ashish.shukla1 — Mon, 21 Jan 2013 06:54:51 GMT

Hi Saurabh,

Saurabh cisco calls this a virtualized multi tenant architecture, here is the link to that

http://www.cisco.com/en/US/docs/solutions/Enterprise/Data_Center/VMDC/2.1/implementation_guide/implement.html#wp1125564

In this doc you will see that OSPF is used to exchange the routes, but in the doc a fwsm is used while i am looking for ASA contexts.

If someone had worked on this type of tenant architecture with ASA, so please share experience which might be helpful.

Ashish Shukla

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

ashish.shukla1 — Mon, 21 Jan 2013 07:04:50 GMT

Hi Michal Switch Config on interface is as below:-

interface port-channel13

switchport

switchport mode trunk

switchport trunk allowed vlan 1021,1022

vpc 13

port-channel summary

13 Po13(SU) Eth LACP Eth1/1(P)

interface Ethernet1/1

description To EMDC1-ASA01-A

switchport

switchport mode trunk

switchport trunk allowed vlan 1021,1022

rate-mode dedicated force

channel-group 13 mode active

no shutdown

interface Vlan1021

no shutdown

vrf member VRF-X

no ip redirects

ip address 10.11.11.251/24

ip router ospf 1 area 0.0.0.1

hsrp version 2

hsrp 1021

preempt

priority 255

timers 1 4

ip 10.11.11.254

interface Vlan1022

no shutdown

vrf member VRF-Y

no ip redirects

ip address 10.11.12.251/24

ip router ospf 1 area 0.0.0.1

hsrp version 2

hsrp 1022

preempt

priority 255

timers 1 4

ip 10.11.12.254

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

MarekVanco_2 — Thu, 16 May 2013 17:08:02 GMT

hey, how did you end up fixing this?

thanks

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

saurabhgoel169 — Fri, 17 May 2013 02:16:00 GMT

Hi Marek,

we had created three separate SVI in switch for each VRF and correspondingly three subinterface on ASA firewall.

the route the traffic towards VLAN and subinterfaces.

Above soluting is working with static routing and OSPF also.

if you need any help regarding this.. let me know.

Thanks

Saurabh Goel

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

aalviola — Tue, 11 Jun 2013 21:52:57 GMT

Hi Saurabh;

We are going to implement virtualized multi-tenancy. I need help on this, it would be great if you can sens/show how to configure it on the 7K (multi vrf, trunking vlans which is members of vrf, routing) and how it is configured on the ASA. need poc this solution. THANKS -- Adlai

Different three VRF connectivity on Nexus 7 K with cisco ASA 558

saurabhgoel169 — Wed, 12 Jun 2013 04:54:31 GMT

Hi Adlai,

Let me know the requirements and diagram, so i could explain the exfiguration to you.

Thanks

Saurabh