topic Allow all inside VLANS to access internet and each other in Network Security

Allow all inside VLANS to access internet and each other

alibris — Mon, 11 Mar 2019 22:15:26 GMT

I have an ASA at a remote office. They have two VLANS. One for 192.168.0.0/24 called 'inside'. The other for 192.168.1.0/24 called 'inside2'. The 'inside' vlan has no issue with accessing the internet. Inside2 can't access anything even though from the NAT configuration it looks like it should be able to. Are there settings that need to be set to allow 'inside2' out of it's box? I have settings for

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

And my NAT looks like this

object network Private_Out

nat (any,outside) static interface

Translations look like this.

phasa01# show xlate

1 in use, 1 most used

Flags: D - DNS, i - dynamic, r - portmap, s - static, I - identity, T - twice

NAT from any:0.0.0.0/0 to outside:X.X.X.X

flags s idle 35:13:54 timeout 0:00:00

What am I missing here?

Thanks

Re: Allow all inside VLANS to access internet and each other

andrew.prince — Tue, 17 Jan 2012 07:55:22 GMT

Check your license

Sent from Cisco Technical Support iPad App

Re: Allow all inside VLANS to access internet and each other

Julio Carvajal — Tue, 17 Jan 2012 15:01:09 GMT

Hello Michael,

Is this a 5505 running a base license?

Can you provide the following commands:

Sh run nat

sh run nameif

sh run access-group

Regards,

Julio

Re: Allow all inside VLANS to access internet and each other

alibris — Tue, 17 Jan 2012 15:08:08 GMT

It has the sec-plus and a couple of others. What license does it need?

Ill get the output from it once I am in front of it in anhour.

Allow all inside VLANS to access internet and each other

alibris — Tue, 17 Jan 2012 16:22:28 GMT

Here is the output from the show runs...

phasa01# show run nameif

interface Vlan1

nameif inside

security-level 100

interface Vlan2

nameif outside

security-level 0

interface Vlan12

nameif inside2

security-level 100

phasa01# show run nat

object network Private_Out

nat (any,outside) static interface

phasa01# show run access-group

access-group OUTSIDE_IN_ACL in interface outside

Here is the license output

Licensed features for this platform:

Maximum Physical Interfaces : 8 perpetual

VLANs : 20 DMZ Unrestricted

Dual ISPs : Enabled perpetual

VLAN Trunk Ports : 8 perpetual

Inside Hosts : Unlimited perpetual

Failover : Active/Standby perpetual

VPN-DES : Enabled perpetual

VPN-3DES-AES : Enabled perpetual

AnyConnect Premium Peers : 2 perpetual

AnyConnect Essentials : Disabled perpetual

Other VPN Peers : 25 perpetual

Total VPN Peers : 25 perpetual

Shared License : Disabled perpetual

AnyConnect for Mobile : Disabled perpetual

AnyConnect for Cisco VPN Phone : Disabled perpetual

Advanced Endpoint Assessment : Disabled perpetual

UC Phone Proxy Sessions : 2 perpetual

Total UC Proxy Sessions : 2 perpetual

Botnet Traffic Filter : Disabled perpetual

Intercompany Media Engine : Disabled perpetual

This platform has an ASA 5505 Security Plus license.

Allow all inside VLANS to access internet and each other

andrew.prince — Tue, 17 Jan 2012 16:26:39 GMT

use your favorite search engine and look for "same-security-interface permit inter-interface"

Allow all inside VLANS to access internet and each other

alibris — Tue, 17 Jan 2012 16:35:45 GMT

The feature was already implemented as noted in post 1.

Allow all inside VLANS to access internet and each other

andrew.prince — Tue, 17 Jan 2012 16:40:41 GMT

Sorry - I missed that! To fix you should just need to write a nat statement to "not nat" it between the two interfaces.

Allow all inside VLANS to access internet and each other

alibris — Wed, 18 Jan 2012 18:19:52 GMT

I am running into issues with getting that NAT or no-nat working.. What would the best syntax be for that?

Re: Allow all inside VLANS to access internet and each other

andrew.prince — Wed, 18 Jan 2012 18:34:39 GMT

static (inside,inside2) source << object name 1>> << object name 1>> destination << object name 1 >> << object name 1 >>

Object-group network << object name 1>>

X.x.x.x y.y.y.y = inside ip subnet

Sent from Cisco Technical Support iPad App

Re: Allow all inside VLANS to access internet and each other

alibris — Thu, 19 Jan 2012 17:15:35 GMT

What version of ASA firmware are those commands valid on. I keep getting errors on 8.4(2).

I'm about to take a hammer to the unit. I have others that have never given me this much grief.

Re: Allow all inside VLANS to access internet and each other

Julio Carvajal — Thu, 19 Jan 2012 17:29:12 GMT

Hello Michael,

On 8.4(2)

object network Inside_network

subnet 192.168.0.0 255.255.255.0

object network Inside2_network

subnet 192.168.1.0 255.255.255.0

nat (inside,inside2) source static Inside_network Inside_network

nat (inside2,inside) source static Inside2_network Inside2_network

Let me know the result of this, if you still unable to do it, please provide the following 2 outputs:

packet-tracer input inside tcp 192.168.0.15 1025 192.168.1.15 80

packet-tracer input inside2 tcp 192.168.1.15 1025 192.168.15 80

Regards,

Julio

Rate helpful posts!!!!!

Allow all inside VLANS to access internet and each other

alibris — Fri, 20 Jan 2012 00:51:36 GMT

Perfect. It is working now. Thank you. Now to my next issue.

Allow all inside VLANS to access internet and each other

Julio Carvajal — Fri, 20 Jan 2012 01:33:07 GMT

Hello Michael,

Great to hear that everything is working!!!

Regards,

Julio