cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1018
Views
0
Helpful
10
Replies

Firepower 1010

IgnatAndrei
Level 1
Level 1

Hello,

I have the following situation. We have at work a subnet (192.168.0.0/24)  used by all equipment ( wifi devices, mng for switches, printers etc ) . We have a cisco firepower 1010 and a cisco sw. I created on ftd 1010 on interface Ethernet1/5 two subinterfaces ( vlan 10 with 192.168.10.0/24 subnet and vlan 20 with 192.168.20.0/24 subnet ) . I connected the ftd 1010 port 5 to the switch and the port on the switch i've configured it in trunk mode with vlan 10,20 . I've connected a pc in switch and set that port in access vlan 10 . The problem is that from that PC ( 192.168.10.20 ) i can ping the gateway but cannot ping a pc from the 192.168.0.0/24 subnet or viceversa. I've configured object "new_subnet" with 192.168.10.0/24 and policies where i've set allow from 192.168.0.0/24 subnet to 192.168.10.0/24 subnet and viceversa and still doesent work.

10 Replies 10

@IgnatAndrei it's possibly a NAT issue, assuming you've configured NAT to allow these networks to access the internet.

You will need to create NAT exemption rules between these networks, to ensure traffic is not translated. These NAT rules would be above your Auto NAT rules used for internet access.

 

In addition, you can run packet-tracer, this will provide more information as to where the issue lies.

@Rob Ingram thx for the answer. Unfortunately i`m newbie with cisco firewalls, can you please guide me ? I've made a pic with the NAT menu. I don`t also understand what has to do NAT with inter-vlan routing. I cannot access the other vlan locally , i don't what to acces it from internet. I think the problem may be with the access list. But i've created rule and still doesent work.

Thx

@IgnatAndrei because traffic from one VLAN would be translated behind the FTD interface, unless configure not to.

 

I cannot see your rules behind to determine if they are conflicting, but you need to define Manual NAT rules as per the example below.

 

1.png

 

this rule ensures traffic between vlan5 and vlan6 networks are not translated.

 

Running packet-tracer as requested, would confirm the packet flow through the firewall and confirm my suspicion.

I`ve attached some pictures to better understand the router configuration.

This in my subinterface configuration :

interface5.png

and this is subinterface config:

imprimante_subinterface.png

 

eq_management_subinterface.png

I want that from wifi_lan to access imprimante subnet. This is what i have when select add nat rulenat rule.png

I don`t know how to use packet tracer from cli

@IgnatAndrei 

 

Manual NAT/ Static

 

Source interface: imprimante

Original source: 192.168.10.0

Translated source: 192.168.10.0

Destination interface: eq_management

Original destination: 192.168.20.0

Translated destination: 192.168.20.0

I will ckeck tomorrow and see if it works. I also have other subnets configured on ethernet 2,3,4 on firepower and i cannot see any rule in nat and i can ping from one subnet to another. This rule is applyed only whem you create subinterfaces or is the default behavior that you have to implement ? If is that, then why other subnets can ping each other without any nat rule ? Thx

You must make sure that the both VLAN in same Zone.

@MHM Cisco World they are in the same Security zone and it does not work.

@Rob Ingram i want from wifi to imprimante . But i'm kind off affraid to create the rule to not break somethink...

I mean is there a way to schedule a reboot if i make the rule and deploy and if something went wrong to reboot and perform a rollback to initial configuration ?

IgnatAndrei
Level 1
Level 1

Hello,

Any help please ? 

thx

Review Cisco Networking for a $25 gift card