I have a LAN subnet 192.168.199.64/28 and a server LAN subnet 192.168.99.0/24 and am unable to communicate between the two of them. I get successful traces in packet-tracer is I try and trace from a 192.168.199.68 address to 192.168.99.203 using https (this device is an Ilo card listening on 443).
Can someone please review my configuration and advise?
Thank you very much in advance
ASA Version 9.8(2)
!
names
name 192.168.99.0 Net-JA-SERVERS
name 192.168.199.64 Net-JA-NETWORK
!
interface GigabitEthernet1/1
description Trunk for providers, dmz1 and outside
speed 1000
duplex full
nameif outside
security-level 0
ip address x.x.x.x x.x.x.x
!
interface GigabitEthernet1/2
description Inside-Interface
speed 1000
duplex full
nameif inside
security-level 100
ip address 192.168.199.65 255.255.255.240
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 8.8.8.8 outside
name-server 8.8.4.4 outside
name-server 1.1.1.1 outside
domain-name company.com
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
object network NETWORK_OBJ_192.168.0.8_29
subnet 192.168.0.8 255.255.255.248
object network Default-Gateway
host 192.168.199.64
description IP Default-Gateway
object network DNS-Google
host 1.1.1.1
description DNS-Google
object network Net-JA-SERVERS
subnet 192.168.99.0 255.255.255.0
object network Net-JA-NETWORK
subnet 192.168.199.64 255.255.255.240
object network Net-JA-SERVERS-OutsideNAT
subnet 192.168.99.0 255.255.255.0
object network Net-JA-NETWORK-OutsideNAT
subnet 192.168.199.64 255.255.255.240
object-group network DM_INLINE_NETWORK_1
network-object object Default-Gateway
network-object object DNS-Google
object-group network DM_INLINE_NETWORK_2
network-object object Default-Gateway
network-object object DNS-Google
object-group network obj-JA-SERVERS
network-object Net-JA-SERVERS 255.255.255.0
object-group network obj-JA-NETWORK
network-object Net-JA-NETWORK 255.255.255.240
object-group network NONAT
network-object Net-JA-SERVERS 255.255.255.0
network-object Net-JA-NETWORK 255.255.255.240
object-group network NET-TIALL
network-object Net-JA-NETWORK 255.255.255.240
network-object Net-JA-SERVERS 255.255.255.0
access-list inside_access_in extended permit ip any 149.97.188.4 255.255.255.252
access-list inside_access_in remark Alllow Internal, Ping to google
access-list inside_access_in extended permit icmp 192.168.199.64 255.255.255.240 object-group DM_INLINE_NETWORK_1
access-list inside_access_in extended permit ip 192.168.199.64 255.255.255.240 any
access-list inside_access_in extended permit tcp any4 host 192.168.99.76
access-list inside_access_in extended permit ip any 192.168.199.64 255.255.255.240
access-list inside_access_in extended permit ip 192.168.99.0 255.255.255.0 any
access-list inside_access_in remark Alllow Internal, Ping to google
access-list inside_access_in extended permit icmp 192.168.99.0 255.255.255.0 object-group DM_INLINE_NETWORK_1
access-list inside_access_in extended permit ip any 192.168.99.0 255.255.255.0
access-list inside_access_in remark Alllow Internal, Ping to google
access-list inside_access_in extended permit ip object-group obj-JA-NETWORK any
access-list outside_access_in remark Internal Network, google ping
access-list outside_access_in extended permit icmp object-group DM_INLINE_NETWORK_2 192.168.199.64 255.255.255.240
access-list outside_access_in remark Internal Network, google ping
access-list outside_access_in remark the following 1 line allows traffic between NY4 LANs
access-list outside_access_in extended permit ip object-group NET-TIALL any4
access-list outside_access_in remark The following 4 lines are to allow ICMP for Ping and Traceroute
access-list outside_access_in extended permit icmp any4 any4 echo
access-list outside_access_in extended permit icmp any4 any4 echo-reply
access-list outside_access_in extended permit icmp any4 any4 time-exceeded
access-list outside_access_in extended permit icmp any4 any4 traceroute
access-list outside_access_in extended permit icmp object-group DM_INLINE_NETWORK_2 192.168.99.0 255.255.255.0
access-list outside_access_in remark Internal Network, google ping
access-list inside_access_out extended permit ip any4 object-group obj-JA-SERVERS inactive
access-list inside_access_out remark The following line permits all other traffic
access-list inside_access_out extended permit ip any4 any4
access-list inside_access_out extended permit ip object-group obj-JA-NETWORK interface inside
access-list inside_access_out remark The following line permits all other traffic
access-list inside_access_out remark This access-list is to filter traffic from the inside going out
access-list inside_access_out remark the following 1 line allows traffic between NY4 LANs
access-list inside_access_out extended permit ip any4 object-group NET-TIALL inactive
pager lines 24
logging enable
logging timestamp
no logging hide username
logging standby
logging emblem
logging buffer-size 1048576
logging asdm-buffer-size 200
logging monitor informational
logging buffered warnings
logging trap debugging
logging history warnings
logging asdm informational
mtu outside 1500
mtu dmz1 1500
mtu inside 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-782.bin
asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source dynamic any interface
nat (inside,outside) source static Net-JA-NETWORK Net-JA-NETWORK destination static NONAT NONAT
access-group outside_access_in in interface outside
route outside 0.0.0.0 0.0.0.0 x.x.x.x 1
route inside Net-JA-SERVERS 255.255.255.0 192.168.99.252 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http 192.168.1.0 255.255.255.0 inside
http Net-JA-SERVERS 255.255.255.0 inside
http 192.168.199.0 255.255.255.240 inside
http Net-JA-NETWORK 255.255.255.240 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec ikev1 transform-set FirstSet esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal secure_proposal
protocol esp encryption des
protocol esp integrity md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map dyn1 1 set ikev1 transform-set FirstSet
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65533 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65533 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-192-SHA ESP-AES-256-SHA ESP-3DES-SHA ESP-DES-SHA ESP-AES-128-SHA-TRANS ESP-AES-192-SHA-TRANS ESP-AES-256-SHA-TRANS ESP-3DES-SHA-TRANS ESP-DES-SHA-TRANS
crypto map mymap 1 ipsec-isakmp dynamic dyn1
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpool policy
crypto ikev1 enable outside
crypto ikev1 policy 1
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 43200
telnet timeout 5
ssh stricthostkeycheck
ssh 192.168.0.0 255.255.0.0 inside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 86400
dhcpd auto_config outside
!
dhcpd address 192.168.199.70-192.168.199.75 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
enable outside
cache
disable
error-recovery disable
group-policy DefaultRAGroup internal
group-policy DefaultRAGroup attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol l2tp-ipsec
default-domain value company.com
group-policy DfltGrpPolicy attributes
dns-server value 8.8.8.8
default-domain value company.com
group-policy Remote internal
group-policy Remote attributes
dns-server value 8.8.8.8 8.8.4.4
vpn-tunnel-protocol ikev1
default-domain value company.com
dynamic-access-policy-record DfltAccessPolicy
tunnel-group DefaultRAGroup general-attributes
address-pool temppool
default-group-policy DefaultRAGroup
tunnel-group DefaultRAGroup ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group ipsec_vpn type remote-access
tunnel-group ipsec_vpn general-attributes
address-pool temppool
tunnel-group xxxxxxx type remote-access
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
