Failed to Locate Egress Interface

DEWHA.DATACOM · ‎02-11-2014

Hello All,

So I have an ASA 5505 that was working fine up until our gateway supplier changed it's firewall and where it was connected. Anyway since then we get an error saying "failed to locate egress interface" and i'm not sure why.

Below is a sanitised copy of the config

SA Version 8.4(1)

!

hostname INTER-xxxxx-FW

names

!

interface Vlan1

no nameif

no security-level

no ip address

!

interface Vlan2

nameif AAAA

security-level 0

ip address x.116.250.2 255.255.255.252

!

interface Vlan160

nameif inside

security-level 100

ip address x.x.160.50 255.255.255.0

!

interface Vlan200

nameif sanmng

security-level 0

ip address 172.x.6.1 255.255.255.0

!

interface Ethernet0/0

switchport access vlan 160

!

interface Ethernet0/1

switchport access vlan 2

!

interface Ethernet0/2

description SAN Management

switchport access vlan 200

!

interface Ethernet0/3

shutdown

!

interface Ethernet0/4

!

interface Ethernet0/5

shutdown

!

interface Ethernet0/6

shutdown

!

interface Ethernet0/7

shutdown

!

ftp mode passive

object-group network XXXXX_SUBNETS

network-object x.x.0.0 255.255.252.0

network-object x.x.8.0 255.255.255.0

network-object x.x.9.0 255.255.255.0

network-object x.x.10.0 255.255.255.0

network-object x.x.11.0 255.255.255.0

network-object x.x.12.0 255.255.255.0

object-group network YYYY_PE

network-object host x.x.26.21

network-object host x.x.26.22

object-group service XXXX_TCP_PORTS tcp

port-object eq https

object-group network WWWW_PE

network-object host XXXXPRCSG01

object-group network ZZZZZ_SUBNETS

network-object x.x.0.0 255.255.0.0

object-group network SAN_MANAGEMENT_SUBNET

network-object 172.X.6.0 255.255.255.0

object-group network HITACHI_SAN_MONITORING

network-object host 207.126.254.52

access-list ACL_XXXX_IN extended permit tcp object-group XXXX_SUBNETS object-group WWWW_PE object-group XXXX_TCP_PORTS

access-list ACL_XXXX_IN extended permit icmp any any

access-list ACL_XXXX_IN extended deny ip any any

access-list ACL__ACCESS_OUT extended permit tcp object-group ZZZZ_SUBNETS object-group YYYY_PE object-group XXXX_TCP_PORTS

access-list ACL__ACCESS_OUT extended permit icmp any any

access-list ACL__ACCESS_OUT extended deny ip any any

access-list ACL_SAN_ACCESS_OUT extended permit tcp object-group SAN_MANAGEMENT_SUBNET object-group HITACHI_SAN_MONITORING eq https

access-list ACL_SAN_ACCESS_OUT extended permit icmp any any

access-list ACL_SAN_ACCESS_OUT extended deny ip any any

access-group ACL_XXXX_IN in interface AAAA

access-group ACL__ACCESS_OUT in interface inside

access-group ACL_SAN_ACCESS_OUT in interface sanmng

route inside 10.X.32.0 255.255.255.0 155.187.160.1 1

route gbrmpa X.X.2.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.3.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.8.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.9.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.10.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.11.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.12.0 255.255.255.0 X.116.250.1 1

route gbrmpa x.x.26.21 255.255.255.255 X.116.250.1 1

route gbrmpa x.x.26.22 255.255.255.255 X.116.250.1 1

route inside x.x.0.0 255.255.0.0 X.X.160.1 1

route inside 207.126.254.52 255.255.255.255 X.X.160.1 1

So traffic coming in from interface AAAA (Vlan 2) can get to it's destination happily enough but when the SAN management subnet 172.x.6.0/24 tries to connect to Hitachi out on the web that's when we get the error message.

I'm not great with FW's so any advice would be greatly appreciated.

Jon Marshall · ‎02-11-2014

Unless you have missed it out you don't seem to have a default route pointing to the next hop to the internet ie. you should have -

route AAAA 0.0.0.0 0.0.0.0 x.116.250.1

Jon

DEWHA.DATACOM · ‎02-11-2014

Sorry the traffic from AAAA works fine. It traffic from sanmng that doesn't work.

We have the below route that points traffic for Hitachi via out next hop.

route inside 207.126.254.52 255.255.255.255 X.X.160.1 1

Jon Marshall · ‎02-11-2014

So is the internet reachable via your inside interface ?

What changes were actually made by your provider ie. in terms of location ?

Jon

DEWHA.DATACOM · ‎02-11-2014

Yes it is.

Essentially we had the below (basic diagram)

FW-------Core Switch----------Datacentre SW-------servers

|

Old gateway

The old gateway was a Cisco router that then connected to the providers datacentre. We now essentially have the below

FW-------Core SW-----------Datacentre SW--------Servers

|

New Gateway FW

The new gateway is now a fortinet firewall.

Jon Marshall · ‎02-11-2014

Did you use the same addressing when the new device was introduced. ie. the arp cache on the ASA would need to have updated to the new mac address.

If you did readdress the inside interface have you checked your xlate table to clear out any old translations.

Other than that, i know this is stating the obvious but if you haven't changed anything and it worked with a router but not now the provider gateway is a firewall that does suggest it may be an issue with their firewall.

Jon

DEWHA.DATACOM · ‎02-11-2014

We haven't readdresssed anything. As far as the config for the fw goes it has not been touched. The only thing I had to do post the migration was change a route on our core switches for the 172.x.6.0/24 network.

So on the Datacentre SW we have a route pointing to the Core SW which that then points to the FW.

If there was an issue with the providers FW would the ASA show this error?

Jon Marshall · ‎02-11-2014

If there was an issue with the providers FW would the ASA show this error?

Good point

Can you just explain this -

in your original setup the ASA was connected to the core switch via the inside interface and the router was also connected to the core switch. So were they in the same vlan ?

If so is that vlan now extended from the core switch to the DC switch because you talk about having to add a route to the DC switch which suggests the link between the core switch and the DC switch is L3.

But that wouldn't work if the ASA inside interface and the provider firewall interface are meant to be in the same subnet.

Can you ping the provider firewall from the ASA ?

Jon