03-08-2011 09:50 AM - edited 03-11-2019 01:03 PM
Solved! Go to Solution.
03-08-2011 10:52 AM
on the ASA :-
asa(config)#route inside 192.168.4.0 255.255.255.0 192.168.10.2
asa(config)#route inside 192.168.5.0 255.255.255.0 192.168.10.2
asa(config)#route inside 192.168.3.0 255.255.255.0 192.168.10.2
Manish
03-08-2011 10:00 AM
Can you please post your topology with ip addressing subnets between the asa ,
router and lan. Need to see the sh route on asa and sh ip route on the router. Seems like your missing routes.
Manish
03-08-2011 10:00 AM
It sounds like the ASA does not have a route to the inside LAN network. When you ping from the LAN, the return packets don't have a route back so they follow the default route to the Internet. You need to add a route for the LAN network pointing to the router.
03-08-2011 10:35 AM
ASA inside IP: 192.168.10.1/24 to Router gig0/0: 192.168.10.2/24.
I have a default route in router as:
ip route 0.0.0.0 0.0.0.0 192.168.10.1
I though that should take care of it, but it did not.
ASA config
ASA Version 8.2(1)
!
hostname ciscoasa
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address 2xx.xx.xxx.xxx 255.255.255.252
!
interface GigabitEthernet0/1
nameif inside
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
ftp mode passive
access-list OUTSIDE_IN_ACL extended permit icmp any any echo-reply
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
access-group OUTSIDE_IN_ACL in interface outside
route outside 0.0.0.0 0.0.0.0 200.32.255.177 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
dynamic-access-policy-record DfltAccessPolicy
http server enable
http 192.168.1.0 255.255.255.0 management
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd address 192.168.1.2-192.168.1.254 management
dhcpd enable management
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:035a0842d1fd3c38999ffefe2ed24554
: end
ciscoasa#
Router config
Current configuration : 6301 bytes
!
version 15.0
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname yourname
!
boot-start-marker
boot-end-marker
!
logging buffered 51200 warnings
!
no aaa new-model
!
no ipv6 cef
ip source-route
ip cef
!
!
ip dhcp excluded-address 192.168.3.1
ip dhcp excluded-address 192.168.5.1
ip dhcp excluded-address 192.168.5.254
!
ip dhcp pool USERSLAN
network 192.168.3.0 255.255.255.0
default-router 192.168.3.1
dns-server 192.168.4.2
lease 60
!
ip dhcp pool IT_DEPARTMENT
network 192.168.5.0 255.255.255.0
default-router 192.168.5.1
dns-server 192.168.4.2
lease 60
!
!
!
interface GigabitEthernet0/0
description $ETH-LAN$$ETH-SW-LAUNCH$$INTF-INFO-GE 0/0$
ip address 192.168.10.2 255.255.255.0
duplex auto
speed auto
!
interface GigabitEthernet0/1
no ip address
duplex auto
speed auto
!
interface GigabitEthernet0/1.4
encapsulation dot1Q 4
ip address 192.168.4.252 255.255.255.0
ip nat inside
ip virtual-reassembly
!
interface GigabitEthernet0/1.5
encapsulation dot1Q 5
ip address 192.168.5.1 255.255.255.0
ip nat inside
ip virtual-reassembly
interface GigabitEthernet0/1.10
encapsulation dot1Q 10
ip address 192.168.3.1 255.255.255.0
ip nat inside
ip virtual-reassembly
!
ip route 0.0.0.0 0.0.0.0 192.168.10.1
control-plane
!
line con 0
login local
line aux 0
line vty 0 4
end
yourname#
03-08-2011 10:52 AM
on the ASA :-
asa(config)#route inside 192.168.4.0 255.255.255.0 192.168.10.2
asa(config)#route inside 192.168.5.0 255.255.255.0 192.168.10.2
asa(config)#route inside 192.168.3.0 255.255.255.0 192.168.10.2
Manish
03-08-2011 11:00 AM
Thanks Manisharora111. Adding the routes in the ASA fixed my problem. Thank you!
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: