cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1149
Views
0
Helpful
2
Replies

Firewall in transparent Mode and LAN Primary IP is reachable but Secondary IP is not accessible.

PakistanMNP
Level 1
Level 1

Dear All,

I have replaced my old cisco 5510 Firewall with a new 5516 NGFW. My edge router 2911 has primary and secondary IP address on a LAN connecting interface. Before replacing the old firewall, primary and secondary IP gateway addresses were reachable from LAN users. After the replacement, primary gateway is reachable from lan side but secondary is not reachable. Please see the below packet flow diagram and running config of cisco ASA 5516-X

 

End Users -------> Switch 2960-X ------> Transparent Firewall 5516-X ------->  2911 Router ------> Internet

 

End users IP: 192.168.0.254/24 and Gateway 192.168.0.3

End users IP: 192.168.222.254/254 and Gateway 192.168.222.3

 

Switch 2960-X:

All ports in VLAN-2. Gig 1/0/24 is connecting inside interface of Firewall.

Interface VLAN-2 IP is 192.168.0.6/24 and Gateway 192.168.0.3.

 

Firewall 5516-X: 

Interface bvi 2 ip address is 192.168.0.9 255.255.255.0

Default route towards 192.168.0.3

BVI 2 is mapped on Gig 1/1. Gig 1/1 is an inside interface connecting with switch 2960-X. Security Level 100

BVI 2 is mapped on Gig 1/8. Gig 1/8 is an outside interface connecting with Router Gig 0/0. Security Level 0

inside interface policy is permit any any.

outside interface policy is source 192.168.0.3, 192.168.222.3 and destination any, service any, action permit.

ICMP is allowed on global inspection policy.

 

Router 2911:

Gig 0/0 primary IP is 192.168.0.3/24 and secondary IP is 192.168.222.3

 

 

Please suggest.

 

1 Accepted Solution

Accepted Solutions

On the FTD, go to CLI, try to capture traffic with trace or run packet
trace to see why traffic isn't working. If you have two bridge groups each
with its BVI interface then it should work.

View solution in original post

2 Replies 2

On the FTD, go to CLI, try to capture traffic with trace or run packet
trace to see why traffic isn't working. If you have two bridge groups each
with its BVI interface then it should work.

Hi Mohammed al Baqari,

 

Thank you for your valuable guidelines. Issue resolved by creating multiple bridge groups and their respective BVIs.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: