08-17-2015 01:56 PM - edited 03-11-2019 11:26 PM
On an ASA 5505 Ver 8.2(5) I have the ability to access internet from primary vlan. However, when I added an additional vlan I'm not able to access the internet from that vlan. I'm able to get out to internet on VLAN1. However, I'm not on VLAN12. I have the security plus license for this appliance. Any assistance I can get with this is greatly appreciated.
--Clayton
Solved! Go to Solution.
08-18-2015 08:09 AM
It shouldn't make any difference whether you use a trunk or not.
Your question is slightly unclear, what exactly do you want to do ?
Jon
08-17-2015 02:16 PM
Clayton
You need to add either "nat (ipcamera) 1 0.0.0.0 0.0.0.0" or "nat (ipcamera) 1 192.168.12.0 255.255.255.0" to your configuration.
Jon
08-17-2015 04:50 PM
Hello Jon! I've tried both with no success.
08-18-2015 04:11 AM
Can you post output of -
"packet-tracer input inside tcp 192.168.12.10 12345 8.8.8.8 www"
From the ASA can you ping a 192.168.12.x client ?
Jon
08-18-2015 05:38 AM
Here you go!
Result of the command: "packet-tracer input inside tcp 192.168.12.10 12345 8.8.8.8 www"
Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in 0.0.0.0 0.0.0.0 outside
Phase: 2
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 3
Type: NAT-EXEMPT
Subtype:
Result: ALLOW
Config:
match ip inside 192.168.12.0 255.255.255.0 outside any
NAT exempt
translate_hits = 1, untranslate_hits = 0
Additional Information:
Phase: 4
Type: NAT
Subtype:
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any outside any
dynamic translation to pool 1 (65.114.22.82 [Interface PAT])
translate_hits = 266513, untranslate_hits = 168014
Additional Information:
Phase: 5
Type: NAT
Subtype: host-limits
Result: ALLOW
Config:
nat (inside) 1 0.0.0.0 0.0.0.0
match ip inside any inside any
dynamic translation to pool 1 (No matching global)
translate_hits = 0, untranslate_hits = 0
Additional Information:
Phase: 6
Type: IP-OPTIONS
Subtype:
Result: ALLOW
Config:
Additional Information:
Phase: 7
Type: FLOW-CREATION
Subtype:
Result: ALLOW
Config:
Additional Information:
New flow created with id 1441990, packet dispatched to next module
Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow
I am able to ping a 192.168.12.x client from the ASA
08-18-2015 05:51 AM
Not sure what is happening here.
The output suggests you are matching the "ip nat (inside) 1 0.0.0.0 0.0.0.0" entry but you shouldn't be.
So is the client port on the switch in vlan 12 and how is the switch connected to the ASA ie. what is the configuration on the port on the switch that connects to e0/7 on your ASA ?
Also can you attach the configuration you are currently working with ?
Jon
08-18-2015 06:41 AM
08-18-2015 06:47 AM
You have this line -
access-list inside_nat0_outbound extended permit ip 192.168.12.0 255.255.255.0 any
and the NAT exemption ie. "nat (inside) 0 access-list <acl name>" takes precedence if I remember correctly.
If that line is for VPN then you need to make the destination the same as the other line ie. 192.168.5.0 255.255.255.0 but you can't use any because that includes internet.
Jon
08-18-2015 07:11 AM
Seems to be working now. Below is what I changed:
no access-list inside_nat0_outbound extended permit ip 192.168.12.0 255.255.255.0 any
access-list inside_nat0_outbound extended permit ip 192.168.12.0 255.255.255.0 192.168.5.0 255.255.255.0
The 192.168.12.X is able to get to internet now.
Last issue is I'm not able to route between these two vlans. Should I create another discussion for this issue?
--Clayton
08-18-2015 07:20 AM
Clayton
You won't be able to route between vlans without setting up NAT between the interfaces ie.
static (inside,ipcamera) 192.168.11.0 192.168.11.0 255.255.255.0
static (ipcamera,inside) 192.168.12.0 192.168.12.0 255.255.255.0
Jon
08-18-2015 08:03 AM
Can this be accomplished without the connection to the switch not being a trunk?
08-18-2015 08:09 AM
It shouldn't make any difference whether you use a trunk or not.
Your question is slightly unclear, what exactly do you want to do ?
Jon
08-18-2015 08:12 AM
I just want to be able to pass traffic between the two vlans.
08-18-2015 08:13 AM
Then you should be fine with what you have as long as you add those NAT statements.
Is everything working now ?
Jon
08-18-2015 08:18 AM
I get the following error message when applying those statements:
Result of the command: "static (inside,ipcamera) 192.168.11.0 192.168.11.0 255.255.255.0"
static (inside,ipcamera) 192.168.11.0 192.168.11.0 255.255.255.0
^
ERROR: % Invalid input detected at '^' marker.
Result of the command: "static (ipcamera,inside) 192.168.12.0 192.168.12.0 255.255.255.0"
static (ipcamera,inside) 192.168.12.0 192.168.12.0 255.255.255.0
^
ERROR: % Invalid input detected at '^' marker.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide