Trouble with internet connectivity on ASA inside interfaces.

[tmorton111]

I have a Cisco ASA 5510 with 3 inside interfaces each connected to a 3750X switch port in a vlan. Outside interface is connected to external router with 209.155.x.x public IP. Static route exists for outbound traffic on outside interface.

3750X is configured for inter-vlan routing. VLANs 10, 20, and 30 have 172.16.x.1 IP address with static routes pointing to the each of the ASA inside interfaces - 172.16.x.254. Connected hosts are configured with gateways pointing to the appropriate vlan interface IP - 172.16.x.1.

Inter-vlan routing appears to be working - I can ping back and forth between hosts on different vlans, and I can ping each vlan IP.

I can also ping each ASA inside interface from a host in the appropriate vlan, but I cannot ping internet sites (4.2.2.2 or 8.8.8.8) from hosts on the
inside interfaces.

I can ping 4.2.2.2 from the ASA CLI. I can ping internal hosts on vlans 10,20,30 from the ASA CLI. But, no luck with pinging from inside host to internet hosts.

What am I missing? Configs are attached.

Thanks in advance.

[Jouni Forss]

Hi,

I would suggest not using 3 default routes in this setup as they all configured for the global routing table.

I would suspect that all that is working for your network is mostly due to the fact that both devices can see the networks mentioned as directly connected networks. (Ping from ASA to LAN or LAN to ASA) But as soon as you need to PING a host on the outside network as the traffic reaches the L3 switch there will be 3 default routes configured and the traffic probably will get forwarded through the wrong interface.

You should only configure default route for each network/vlan if you have configured VRFs on the L3 switch (and attached each Vlan interface to their own VRF). This would mean that each network segment would have their own routing table and they would not be directly visible to eachother.

I would consider changing your setup in one of the following ways

• Move the default gateways of the LANs to the ASA by configuring a Trunk interface between the switch and bring the 3 Vlans through it. This would on the other hand eliminate the need to use the L3 Switch as nothing more than normal L2 switch.

OR

• Configure a fourth/4th Vlan and Vlan interface and configure a link network between the L3 Switch and ASA. Then only configure a single default route that points to the before mentioned link networks IP address on the ASA.

- Jouni

[Jouni Forss · Accepted solution]

Example configurations for the above setups could be for example the following (taking to account only the interface configurations)

Trunk to ASA

Switch

interface GigabitEthernet1/0/47

description Trunk to ASA

switchport mode trunk

switchport trunk encapsulation dot1q

switchport trunk allowed vlan add 10,20,30

ASA

interface Ethernet0/1

description Trunk to Switch

no nameif

no security-level

interface Ethernet0/1.10

vlan 10

nameif users

security-level 100

ip address 172.16.10.254 255.255.255.0

!

interface Ethernet0/1.20

vlan 20

nameif servers

security-level 100

ip address 172.16.20.254 255.255.255.0

!

interface Ethernet0/1.30

vlan 30

nameif mgmt

security-level 100

ip address 172.16.30.254 255.255.255.0

• Remove default routes
• Hosts gateway needs to be the ASA interface IP address

New Vlan/Link Network between Switch and ASA

Switch

vlan 100

name SW-to-ASA

interface Vlan100

description SW-to-ASA

ip add 172.16.100.2 255.255.255.0

no shutdown

interface GigabitEthernet1/0/47

description SW-to-ASA

switchport mode access

switchport access vlan 100

spanning-tree portfast

ip route 0.0.0.0 0.0.0.0 172.16.100.1

ASA

interface GigabitEthernet0/1

description ASA-to-SW

nameif lan

security-level 100

ip add 172.16.100.1 255.255.255.0

route inside 172.16.10.0 255.255.255.0 172.16.100.2

route inside 172.16.20.0 255.255.255.0 172.16.100.2

route inside 172.16.30.0 255.255.255.0 172.16.100.2

• Remote other default routes
• Make sure hosts default gateway are the IP addresses on the L3 Switch Vlan interfaces

- Jouni

[Tarik Admani]

Hi,

**I completely missed the attachments (checking via ipad) I will check these later and edit my post

If you issue a show nat detail does the nat configuration cover the translations properly. Also in your default policy-map have to turned added the "inspect icmp"? You may want to turn on monitor debugging and see why the icmp traffic is being dropped. You can also run the packet-tracer command to see if the traffic is allowed:

packet-tracer input inside icmp 0 8 ....(you should be able to use the interactive prompts to walk you through the rest).

Thanks,

Sent from Cisco Technical Support iPad App

[Tarik Admani · Accepted solution]

Try adding the following lines to your global policy and see if the pings will go through:

policy-map global_policy

class inspection_default

  inspect icmp

Thanks,

Tarik Admani
*Please rate helpful posts*

[tmorton111]

Tarik,

I changed our setup per Jouni's recommendations, and that fixed our internet access problem.

But we still could not ping internet hosts from the inside interface. Adding the inspect icmp to our global_policy allowed the pings to go through.

Thanks for your suggestion.

[tmorton111]

Sorry for the delay, just got back to the devices this morning.

I applied the new vlan/link network between ASA and switch config, and things are working great now.

I can access the internet from our internal vlans - 10, 20, and 30.

Thank you for you help!

[Jouni Forss]

Hi,

Thank you for the rating and for letting us know how it went.

I would like to add though that if you decided to configure a link network/Vlan between the L3 Switch and ASA that you wont really be able to control the traffic between the local Vlans other than on the L3 Switch which wouldnt be a desirable solution.

On the other hand if the above is fine and you dont have any need to limit traffic between these Vlans, then there should be no problem.

If you would like to control the traffic between the internal Vlans I would suggest Trunking them to the ASA and therefore moving the internal networks gateway to ASA. Then you could easily make the access rules as you want and monitor the traffic between the internal networks.

Good thing its working now atleast.

I completely forgot to point out the "inspect icmp" configuration.

- Jouni

[zjnbxsspjm]

Hi JouniForss,

I am a little confused about "New Vlan/Link Network between Switch and ASA" , why do we need to create a new vlan 100 and then allocate  GigabitEthernet1/0/47 into vlan 100.And Why don't we configure the ip 172.16.100.2 directly on GigabitEthernet1/0/47. what's the best practice? If we use the vlan method, how did the traffic go from ASA to switch. How does ASA learn the vlan ip ,using broadcast? Thanks!

[Jouni Forss]

Ah,

I guess you might aswell also configure the single physical port you mention as a router port with "no switchport" configuration and avoid all the vlan configurations.

That should be possible too.

- Jouni

[zjnbxsspjm]

Hi JouniForss,

Thanks for your prompt reply.My main concern is how router port communicate with access port in the vlan method scenario.How does the ASA learn arp information of interface vlan 100 to forward traffic?Thanks!

[Jouni Forss]

Hi,

If you have the L3 switch setup where there is an interface Vlan100 and a single port assigned as Access port and this port is used towards the ASA then there should really be no problem related ARP.

ASA will naturally have a "route" configuration for all the network behind its interface pointing to another address on the same network/subnet as its interface. If it doesnt have an ARP information already (which it will) it will simply use ARP to determine the MAC address of the gateway IP address configured in the "route" command and naturally the Vlan100 interface will reply.

For example in my home ASA5505

• ASA LAN interface 10.0.10.2
• ROUTER interface 10.0.10.1

I clear arp on the ASA and have "debug arp" on. The ASA then determines the IP/MAC pair with ARP

arp-req: generating request for 10.0.10.1 at interface LAN

arp-req: request for 10.0.10.1 still  pending

arp-in: response at LAN from 10.0.10.1 aca0.1679.6d1a for 10.0.10.2 0025.45f4.0aa2

- Jouni

[zjnbxsspjm]

Thanks Jouni for the detailed explanation.Really appreciate it.Thanks!