07-03-2013 10:20 PM - edited 03-11-2019 07:06 PM
Hello Experts,
I'm in process of configuring the firewall and switch model 2948G running on CAT OS where I configured sub interfaces and assigned the IP addresses and VLAN on firewall interface and the firewall port is connected with switch port which is a trunk port allowing all the VLAN traffic. Now when I connect any machine with any switch port member of VLAN 1 then I won't able to ping the gateway even I assigned the IP address from the same network of VLAN 1 to switch sc0 port that I can ping so most probably it looks the communication problem in between switch and firewall. The firewall model is asa 5510 with security plus license. Please assist in this and share your thoughts what could be a problem and how to resolve it. I'm not expert in CAT OS and having some problems to troubleshoot the issue.
Thanks
Sent from Cisco Technical Support iPhone App
07-03-2013 10:51 PM
Hi,
Please share your config file on both the device.
Regards
Pankaj
07-03-2013 11:28 PM
Please see the firewall config below which access I have it right now. the switch config I will send it later once my colleague reach at DC as the switch can be accessible via console:
:
ASA Version 8.2(5)
!
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.224
!
interface Ethernet0/1
no nameif
no security-level
no ip address
!
interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Ethernet0/3
<--- More --->
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface Redundant1
member-interface Ethernet0/1
member-interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Redundant1.1
description Management
vlan 1
nameif inside
security-level 100
ip address 10.1.10.1 255.255.255.0
<--- More --->
!
interface Redundant1.2
description DMZ Servers
vlan 2
nameif DMZ
security-level 50
ip address 10.1.12.1 255.255.255.0
!
interface Redundant1.3
description Infrastructure Servers
vlan 3
nameif Infra
security-level 60
ip address 10.1.14.1 255.255.255.0
!
interface Redundant1.4
description Database Servers
vlan 4
nameif database
security-level 90
ip address 10.1.16.1 255.255.255.0
!
boot system disk0:/asa825-k8.bin
ftp mode passive
<--- More --->
access-list dc_splitTunnelAcl standard permit 10.1.10.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.16.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.12.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.14.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 10.1.10.0 255.255.255.0 192.168.11.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
mtu Infra 1500
mtu database 1500
ip local pool DC_Pool 192.168.11.100-192.168.11.254 mask 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface DMZ
ip verify reverse-path interface Infra
ip verify reverse-path interface database
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
<--- More --->
nat (inside) 0 access-list inside_nat0_outbound_1
route outside 0.0.0.0 0.0.0.0 216.182.216.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
<--- More --->
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
management-access inside
threat-detection basic-threat
<--- More --->
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
<--- More --->
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
call-home
<--- More --->
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:ff8c256c0925e4125da7163b1d08a5ba
:
Logoff
07-04-2013 05:18 AM
Please see the switch config as well
!
#time: Fri Jul 5 2013, 12:54:28
!
#version 8.4(11)GLX
!
!
!
#dot1x
set feature dot1x-radius-keepalive disable
!
#system
set system name Switch-Primary
set system location
set system contact
!
#frame distribution method
set port channel all distribution mac both
!
#ip
set interface sc0 1 10.1.10.2/255.255.255.0 10.1.10.255
set interface sl0 down
set interface me1 down
set ip route 0.0.0.0/0.0.0.0 10.1.10.1
set ip alias default 0.0.0.0
!
#set boot command
set boot config-register 0xf
set boot system flash bootflash:cat4000-k9.8-4-11-GLX.bin
!
#multicast filter
set igmp filter disable
!
#module 1 : 0-port Switching Supervisor
!
#module 2 : 50-port 10/100/1000 Ethernet
set trunk 2/12 on dot1q 1-1005,1025-4094
end
Switch-Primary-> (enable)
07-05-2013 10:04 AM
Please assist in this.
Thanks
Sent from Cisco Technical Support iPhone App
07-05-2013 11:28 PM
so you you mean to say you are able to ping from switch when you giving ip address to the port SC0 ..right?
and when you connect any system to any port of VLAN 1 , its not pingable?
please provide details of vlan from switch. (Command is show vlan)
07-06-2013 01:56 AM
No I'm not able to ping from switch to firewall but I can ping from switch to machine vice versa. Please note there is no VLAN configured and all ports are by default assigned to VLAN 1 except port 2/12 which is configured as a trunk port and connected with firewall port where the sub interfaces are configured including VLAN 1 and its IP address that I want to be ping from both switch and machine. Thanks
Sent from Cisco Technical Support iPhone App
07-06-2013 01:57 AM
Chat with me vgupta1912@gmail.com to address this issue, if possible.
Sent from Cisco Technical Support iPhone App
07-06-2013 02:12 AM
You will have to configure VLANs with their IP address in switch as well.
Regards
Pankaj
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: