Showing results for 
Search instead for 
Did you mean: 


Need assist in Config

Hello Experts,
I'm in process of configuring the firewall and switch model 2948G running on CAT OS where I configured sub interfaces and assigned the IP addresses and VLAN on firewall interface and the firewall port is connected with switch port which is a trunk port allowing all the VLAN traffic. Now when I connect any machine with any switch port member of VLAN 1 then I won't able to ping the gateway even I assigned the IP address from the same network of VLAN 1 to switch sc0 port that I can ping so most probably it looks the communication problem in between switch and firewall. The firewall model is asa 5510 with security plus license. Please assist in this and share your thoughts what could be a problem and how to resolve it. I'm not expert in CAT OS and having some problems to troubleshoot the issue.


Sent from Cisco Technical Support iPhone App



Please share your config file on both the device.



Please see the firewall config below which access I have it right now. the switch config I will send it later once my colleague reach at DC as the switch can be accessible via console:


ASA Version 8.2(5)




interface Ethernet0/0

nameif outside

security-level 0

ip address x.x.x.x


interface Ethernet0/1

no nameif

no security-level

no ip address


interface Ethernet0/2

no nameif

no security-level

no ip address


interface Ethernet0/3

<--- More --->


no nameif

no security-level

no ip address


interface Management0/0


no nameif

no security-level

no ip address


interface Redundant1

member-interface Ethernet0/1

member-interface Ethernet0/2

no nameif

no security-level

no ip address


interface Redundant1.1

description Management

vlan 1

nameif inside

security-level 100

ip address

<--- More --->


interface Redundant1.2

description DMZ Servers

vlan 2

nameif DMZ

security-level 50

ip address


interface Redundant1.3

description Infrastructure Servers

vlan 3

nameif Infra

security-level 60

ip address


interface Redundant1.4

description Database Servers

vlan 4

nameif database

security-level 90

ip address


boot system disk0:/asa825-k8.bin

ftp mode passive

<--- More --->

access-list dc_splitTunnelAcl standard permit

access-list dc_splitTunnelAcl standard permit

access-list dc_splitTunnelAcl standard permit

access-list dc_splitTunnelAcl standard permit

access-list inside_nat0_outbound_1 extended permit ip

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu DMZ 1500

mtu Infra 1500

mtu database 1500

ip local pool DC_Pool mask

ip verify reverse-path interface outside

ip verify reverse-path interface inside

ip verify reverse-path interface DMZ

ip verify reverse-path interface Infra

ip verify reverse-path interface database

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

<--- More --->

nat (inside) 0 access-list inside_nat0_outbound_1

route outside 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

<--- More --->

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh outside

ssh timeout 5

console timeout 0

management-access inside

threat-detection basic-threat

<--- More --->

threat-detection statistics access-list

no threat-detection statistics tcp-intercept



class-map inspection_default

match default-inspection-traffic



policy-map type inspect dns preset_dns_map


<--- More --->

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp


service-policy global_policy global

prompt hostname context

call-home reporting anonymous


<--- More --->

profile CiscoTAC-1

  no active

  destination address http

  destination address email

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily





Please see the switch config as well
#time: Fri Jul 5 2013, 12:54:28
#version 8.4(11)GLX

set feature dot1x-radius-keepalive disable
set system name Switch-Primary
set system location
set system contact
#frame distribution method
set port channel all distribution mac both
set interface sc0 1

set interface sl0 down
set interface me1 down
set ip route
set ip alias default
#set boot command
set boot config-register 0xf
set boot system flash bootflash:cat4000-k9.8-4-11-GLX.bin
#multicast filter
set igmp filter disable
#module 1 : 0-port Switching Supervisor
#module 2 : 50-port 10/100/1000 Ethernet
set trunk 2/12 on dot1q 1-1005,1025-4094
Switch-Primary-> (enable)

Please assist in this.

Sent from Cisco Technical Support iPhone App

so you you mean to say you are able to ping from switch when you giving ip address to the port SC0 ..right?

and when you connect any system to any port of VLAN 1 , its not pingable?

please provide details of vlan from switch. (Command is show vlan)

No I'm not able to ping from switch to firewall but I can ping from switch to machine vice versa. Please note there is no VLAN configured and all ports are by default assigned to VLAN 1 except port 2/12 which is configured as a trunk port and connected with firewall port where the sub interfaces are configured including VLAN 1 and its IP address that I want to be ping from both switch and machine. Thanks

Sent from Cisco Technical Support iPhone App


Chat with me to address this issue, if possible.

Sent from Cisco Technical Support iPhone App

You will have to configure VLANs with their IP address in switch as well.



Recognize Your Peers
Content for Community-Ad