topic ASA on Multi-Network in Network Security

ASA on Multi-Network

woodjl1650 — Mon, 11 Mar 2019 21:23:41 GMT

I have three LANs connected to my ASA, all have internet access, but I am not able to ping or access any of the LANs on the inside network. Can you please advise on where I went wrong?

ASA Version 8.2(3)

hostname ciscoasa

enable password DQucN59Njn0OjpJL encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address 192.168.5.1 255.255.255.0

rip send version 1 2

rip receive version 1 2

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

ftp mode passive

access-list 100 extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list 100 extended permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list 100 extended permit ip 192.168.1.0 255.255.255.0 192.168.3.0 255.255.255.0

access-list 100 extended permit ip 192.168.3.0 255.255.255.0 192.168.1.0 255.255.255.0

access-list 100 extended permit ip 192.168.2.0 255.255.255.0 192.168.3.0 255.255.255.0

access-list 100 extended permit ip 192.168.3.0 255.255.255.0 192.168.2.0 255.255.255.0

access-list ripACL_FR standard permit 192.168.1.0 255.255.255.0

access-list ripACL_FR standard permit 192.168.2.0 255.255.255.0

access-list ripACL_FR standard permit 192.168.3.0 255.255.255.0

access-list ripACL_FR standard permit 192.168.5.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

route-map HomeRoute permit 1

match ip address 100

match interface inside

router rip

network 192.168.1.0

network 192.168.2.0

network 192.168.3.0

network 192.168.5.0

redistribute static route-map HomeRoute

default-information originate route-map HomeRoute

version 2

distribute-list ripACL_FR in interface inside

route outside 0.0.0.0 0.0.0.0 68.108.10.1 1

route inside 192.168.1.0 255.255.255.0 192.168.5.1 1

route inside 192.168.1.0 255.255.255.0 192.168.2.1 1

route inside 192.168.1.0 255.255.255.0 192.168.3.1 1

route inside 192.168.2.0 255.255.255.0 192.168.5.1 1

route inside 192.168.2.0 255.255.255.0 192.168.1.1 1

route inside 192.168.2.0 255.255.255.0 192.168.3.1 1

route inside 192.168.3.0 255.255.255.0 192.168.5.1 1

route inside 192.168.3.0 255.255.255.0 192.168.1.1 1

route inside 192.168.3.0 255.255.255.0 192.168.2.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.5.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

dhcpd address 192.168.5.5-192.168.5.36 inside

dhcpd enable inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

service-policy global_policy global

prompt hostname context

Cryptochecksum:14debb742c0a6f337f9f5005a22c9a14

: end

ciscoasa#

Re: ASA on Multi-Network

Julio Carvajal — Mon, 12 Sep 2011 21:12:46 GMT

Hello Jonathan,

Would you mind to add this.

policy-map global_policy

class inspection_default

inspect Icmp

And remember that if you want to ping from a lower security level to a higher there needs to be an ACL allowing this connection.

Regards,

Julio

ASA on Multi-Network

woodjl1650 — Mon, 12 Sep 2011 23:17:17 GMT

Plugged those commands in and still don't have access to the other networks.... I am currently on the 192.168.1.X network, trying to view a wired IP camera on the 192.168.3.X network. I can't access my printer on 192.168.2.X network either...Here is my current running config:

ASA Version 8.2(3)

hostname ciscoasa

enable password DQucN59Njn0OjpJL encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

interface Ethernet0/0

switchport access vlan 2

interface Ethernet0/1

interface Ethernet0/2

interface Ethernet0/3

interface Ethernet0/4

interface Ethernet0/5

interface Ethernet0/6

interface Ethernet0/7

interface Vlan1

nameif inside

security-level 100

ip address 192.168.5.1 255.255.255.0

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

ftp mode passive

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (inside) 1 interface

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

nat (inside) 0 0.0.0.0 0.0.0.0 outside

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.5.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

dhcpd address 192.168.5.5-192.168.5.36 inside

dhcpd enable inside

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

class-map inspection_default

match default-inspection-traffic

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

service-policy global_policy global

prompt hostname context

Cryptochecksum:b108a042cb359e4e4e62a0e4ff00ad70

: end

ASA on Multi-Network

Julio Carvajal — Mon, 12 Sep 2011 23:24:47 GMT

Hello Jonathan,

Add this command:

same-security-traffic permit intra-interface

and try this packet tracer

Packet-tracer input inside tcp 192.168.1.X 1025 192.168.3.X 80

Let me know the output of this,

Thanks

Julio

ASA on Multi-Network

woodjl1650 — Mon, 12 Sep 2011 23:39:14 GMT

It says its allowed under TCP, but when I run the IP tracker on the ASDM, it drops because of NAT. Does my NAT need to be redone?

ciscoasa# packet-tracer input inside tcp 192.168.1.2 http 192.168.3.7 http

Phase: 1

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 0.0.0.0 0.0.0.0 outside

Phase: 2

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 3

Type: NAT

Subtype:

Result: ALLOW

Config:

nat (inside) 1 0.0.0.0 0.0.0.0

match ip inside any outside any

dynamic translation to pool 1 (68.108.12.252 [Interface PAT])

translate_hits = 543, untranslate_hits = 32

Additional Information:

Dynamic translate 192.168.1.2/80 to 68.108.12.252/262 using netmask 255.255.255.255

Phase: 4

Type: NAT

Subtype: host-limits

Result: ALLOW

Config:

nat (inside) 1 0.0.0.0 0.0.0.0

match ip inside any inside any

dynamic translation to pool 1 (192.168.5.1 [Interface PAT])

translate_hits = 0, untranslate_hits = 0

Additional Information:

Phase: 5

Type: HOST-LIMIT

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 6

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Phase: 7

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 598, packet dispatched to next module

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: outside

output-status: up

output-line-status: up

Action: allow

ASA on Multi-Network

Julio Carvajal — Mon, 12 Sep 2011 23:46:49 GMT

The thing is that you are going from and inside Lan to another Lan located on the inside as well.

Did you add the command:

same-security-traffic permit intra-interface

I think this is a routing issue instead of a Natting issue, as we can see on the packet tracer the packet is allowed. but check your Routes:

route inside 192.168.1.0 255.255.255.0 192.168.5.1 1

route inside 192.168.1.0 255.255.255.0 192.168.2.1 1

route inside 192.168.1.0 255.255.255.0 192.168.3.1 1

route inside 192.168.2.0 255.255.255.0 192.168.5.1 1

route inside 192.168.2.0 255.255.255.0 192.168.1.1 1

route inside 192.168.2.0 255.255.255.0 192.168.3.1 1

route inside 192.168.3.0 255.255.255.0 192.168.5.1 1

route inside 192.168.3.0 255.255.255.0 192.168.1.1 1

route inside 192.168.3.0 255.255.255.0 192.168.2.1 1

What is the Ip address of the Layer 3 device on the inside interface, It got to be 192.168.5.something ?

Regards,

ASA on Multi-Network

woodjl1650 — Mon, 12 Sep 2011 23:53:08 GMT

Yes my ASA is 192.168.5.1. Plugged those routes in and still no access. Did the tracer on the ASDM and still says NAT issues.... Any idea?

ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 00:02:25 GMT

If your ASA is 192.168.5.1 yo do not need to added to the static routes, what is the IP address of the router on the inside, and why are you using three diferent next hops to get to the same lan?

Regards

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 00:08:10 GMT

I have three routers going into the ASA, I want seperate LAN for each part of my network. Each router is assigned 192.168.1.1, 192.168.2.1, and 192.168.3.1. I know it seems more than what it should, but this is how I like it. Is there a way to let all of them talk to each other?

Re: ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 00:32:12 GMT

Sure you can do that, but in order for us to help you we will need to know the diagram of your network wich I think is something like this:

(x.x.x.x)R1(x.x.x.x)--------(x.x.x.x)R2(x.x.x.x)---------(x.x.x.x)R3(x.x.x.x)------(192.168.51)ASA(dhcp)---( 68.108.10..1)Internet

But just to let you know each Lan got to have as it default gateway its respective Router, the ASA is only going to work as the default gateway for the network 192.168.5.0

May I have the ip address of each router on both interfaces?

Regards,

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 00:38:38 GMT

Here is my network diagram with all IP address of all my devices. LIke I said, I have the internet on all routers right now, just need to be able to talk to each on.

Re: ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 00:52:08 GMT

Ok so what you will need to do its to create 3 vlans, You already have one Vlan1, you will need to create vlan 3 and vlan 4

Interface vlan 3

nameif DMZ

security-level 100

ip address 192.1683.1 255.255.255.0

Interface vlan 4

nameif DMZ2

security-level 100

ip address 192.168.1.1 255.255.255.0

Then Assing one port to each of that vlan.

You will have to remove the Static Routes except for the one pointing to the outside and then work in static nats and ACLs.

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 01:01:02 GMT

Any way to do with a basic license? I can't do more than 2 vlans.... Grrrr.....

ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 01:06:29 GMT

The way I told you before:

(x.x.x.x)R1(x.x.x.x)--------(x.x.x.x)R2(x.x.x.x)---------(x.x.x.x)R3(x.x.x.x)------(192.168.51)ASA(dhcp)---( 68.108.10..1)Internet

But just to let you know each Lan got to have as it default gateway its respective Router, the ASA is only going to work as the default gateway for the network 192.168.5.0

Regards,

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 01:10:07 GMT

I guess I don't fully understand what you mean by "

(x.x.x.x)R1(x.x.x.x)--------(x.x.x.x)R2(x.x.x.x)---------(x.x.x.x)R3(x.x.x.x)------(192.168.51)ASA(dhcp)---( 68.108.10..1)Internet"

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 01:34:01 GMT

What do each set of (x.x.x.x) R1(x.x.x.x) mean? Is that IP address of R1 then gateway?

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 02:47:00 GMT

IP Address = 192.168.1.1

Default Gateway = 192.168.5.1

WAN IP Address = 192.168.5.3

IP Adress 192.168.2.1

Default Gateway = 192.168.5.1

WAN IP Adress = 192.168.5.4

IP Adress = 192.168.3.1

Default Gateway = 192.168.5.1

WAN IP Adress = 192.168.5.2

Internet IP = 68.108.12.XXX

ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 02:56:26 GMT

Hello Jonathan,

What I mean is that you have 4 diferent networks on the same interface, the only way to set this up is with Layer 3 devices splitting the broadcast domains and the networks.

but to do this each router will need to have a default route pointing to the ASA.

Do you understand what I mean

192.168.1.1 ---R1--192.168.2.2----192.168.2.1---R2------192.168.3.2----192.168.3.1--R3--192.168.5.2----192.168.5.1-ASA--

I hope this show you my point of view,

ASA on Multi-Network

woodjl1650 — Tue, 13 Sep 2011 03:07:39 GMT

Can you explain the 192.168.1.1 R1 192.168.2.2....and so on, I don't get where those IP are supposed to go.

ASA on Multi-Network

Julio Carvajal — Tue, 13 Sep 2011 03:15:47 GMT

Maybe is that I dont understand the topology....

At this moment are you able to ping the interface from all the PCs in the diferent networks?