Unable to pass traffic/ping through FW

[CiscoBrownBelt]

So I have a switch that is directly connected to a ASA5585X.

I can't ping the 192.168.10.10 /24 IP Inside interface from the switch which has just one SVI/VLAN 10 (192.168.10.5).

Since it is directly connected no route is needed, only a route pointing to reach all internal subnets used 192.168.10.5. ( I tried entering static routes anyway)

Both interfaces are up/up including SVI on switch.

I am allowing icmp on the inside ACL.

Anything else I am missing?

[Marius Gunnerud]

The EdgeSw has a 0.0.0.0 route that points to the ASA. Is this not correct?

This is correct

Are you saying without the SVIs on the EdgeSw for the same subnets on the router that point to the ASA that traffic will not transverse the switch and continue to the ASA?

No, the VLANs need to be present on the switch of course, but there is not need for SVI.

As of right now I am a little uncertain what the issue is with VLAN10 between the routers and the switch.  If you want help with this, it would be helpful to see the full running configuration for the switch and the router (remember to remove any public IPs, usernames and passwords).

The 2 redundant interfaces on the ASA I would configure with HSRP and apply the same ACLs and even same nameifs correct?

The ASA is not configured with HSRP, just the routers.  Here is an example of redundant interface configuration.

interface redundant 1

  nameif inside

  security-level 100

  ip address 192.168.1.1 255.255.255.0

  member-interface Gig1/0/1

  member-interface Gig1/0/2

[CiscoBrownBelt]

As of right now I am a little uncertain what the issue is with VLAN10 between the routers and the switch.  If you want help with this, it would be helpful to see the full running configuration for the switch and the router (remember to remove any public IPs, usernames and passwords).

Port on Edge switch the connects to ASA is set for VLAN 11 and I can ping between from SVI 11 (only SVI on the EdgeSw and the ASA Ip on that interface.

Also I think there is some issue with that VLAN or VLANs spanning from within the inside (port on Routers connected to access switch) and outside port (port connected to Edge Switch) as if I connect a cable directly from the AccessSw to the EdgeSw I can now ping any SVI VLAN or any sub-int on the router from any switch or Router. Any ideas why that is the case as it looks light I am just about there?

If need be I may not really need any private IP on the ASA or any device on the Outside interface on out to the ISP.

I can't however ping the outside interface of the ASA or the Edge Router which is connected to the Outside interface of the ASA and I believe I enabled icmp any any on both the "inside and outside" interfaces. See attached topology .

The ASA is not configured with HSRP, just the routers.  Here is an example of redundant interface configuration.

Awesome!  I take it no other features or policies would have to be enabled? Also if I am able to configre 2 identical "inside" interfaces, I could actually remove the EdgeSw and connect IntRt1 to one member-int and IntRt2 to the other correct?  You did mention it is not good if  I am running HSRP on the routers

[Marius Gunnerud]

Any ideas why that is the case as it looks light I am just about there?

Would need to see the configuration on the router and the switch to get an idea.  Is this a setup in a lab (virtual lab) or is it actual hardware / production environment?

I can't however ping the outside interface of the ASA or the Edge Router which is connected to the Outside interface of the ASA and I believe I enabled icmp any any on both the "inside and outside" interfaces. See attached topology .

You will not be able to ping the outside interface of the ASA from the inside network.  You will only be able to ping the ingress interface on the ASA.  As for not being able to ping the EdgeRt, have you enabled ICMP inpsection under the policy-map on the ASA?

Awesome!  I take it no other features or policies would have to be enabled? Also if I am able to configre 2 identical "inside" interfaces, I could actually remove the EdgeSw and connect IntRt1 to one member-int and IntRt2 to the other correct?  You did mention it is not good if  I am running HSRP on the routers

No other features are required for the redundant interface configuration.  However, you cannot remove the EdgeSw and connect the routers to the interfaces on the ASA...well you can, but the results would not be favorable as there will arise some situations where there is a failure int the network but failover will not happen.  For example.  If IntRt1 is connected to the active interface on the ASA and G1 interface failes.  HSRP would failover to IntRt2 but the ASA will not failover the interfaces.  Since the routers are directly connected IntRt2 will be sending traffic to the standby interface which will drop traffic.  It is better to have a switch inbetween.  There are of course ways to get directly connected interfaces to work, but these solutions are unnecessarily complicated and difficult to troubleshoot later.

[CiscoBrownBelt]

Would need to see the configuration on the router and the switch to get an idea.  Is this a setup in a lab (virtual lab) or is it actual hardware / production environment?

Will do I will try and get you that ASAP. Actual hardware.

You will not be able to ping the outside interface of the ASA from the inside network.  You will only be able to ping the ingress interface on the ASA.  As for not being able to ping the EdgeRt, have you enabled ICMP inpsection under the policy-map on the ASA?

I will double check but I believe I already checked and it is. All I need to do is allow my internal subnets through on the Outside interface ACL via "e.g. route outside 192.168.0.0 255.255.0.0 <EdgeRt ip>" correct?

Should I do my PATTING on the FW or the EdgeRouter if there is just the EdgeRt which connects to ISP router?

[Marius Gunnerud]

Do your NATing at the network edge...the router.