ASA Subinterface Configuration Issues

[jimmlegs]

I am trying to change my configuration to serve my network's public IP and DMZ from subinterfaces on the same physical interface. When I configure the public IP address directly on the physical interface I have Inernet access as expected but when I configure it on a subinterface I do not.

I also get the following message in the log indicating that I am spoofing my own address when I try an run ping tests or packet tracers.

%ASA-session-2-106016: Deny IP spoof from (110.97.188.6) to 8.8.8.8 on interface outside

names
name 192.168.68.0 Net-ny2-SERVERS
name 192.168.168.64 Net-ny2-NETWORK
ip local pool temppool 192.168.0.10-192.168.0.15

!
interface GigabitEthernet1/1
description Trunk for providers, dmz1 and outside
speed 1000
duplex full
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1.15
description to outside
vlan 15
nameif outside
security-level 10
ip address 110.97.188.6 255.255.255.252
!
interface GigabitEthernet1/1.100
description to DMZ
vlan 100
nameif dmz1
security-level 50
ip address 110.97.189.193 255.255.255.224 standby 110.97.189.222
!
interface GigabitEthernet1/2
description Trunk for interal networks Inside-Interface
speed 1000
duplex full
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/2.168
description inside interface
vlan 168
nameif inside
security-level 100
ip address 192.168.168.65 255.255.255.240
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/4
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/5
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/6
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/7
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/8
shutdown
no nameif
no security-level
no ip address
!
interface Management1/1
management-only
no nameif
no security-level
no ip address
!
ftp mode passive
dns domain-lookup outside
dns server-group DefaultDNS
name-server 1.1.1.1 outside
name-server 8.8.8.8 outside
name-server 8.8.4.4 outside
domain-name tradeinformatics.com
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network obj_any
subnet 0.0.0.0 0.0.0.0
access-list inside_access_out extended permit ip any4 any4
access-list outside_access_in remark The following 4 lines are to allow ICMP for Ping and Traceroute
access-list outside_access_in extended permit icmp any4 any4 echo
access-list outside_access_in extended permit icmp any4 any4 echo-reply
access-list outside_access_in extended permit icmp any4 any4 time-exceeded
access-list outside_access_in extended permit icmp any4 any4 traceroute
pager lines 24
logging enable
logging timestamp
no logging hide username
logging standby
logging emblem
logging buffer-size 1048576
logging asdm-buffer-size 200
logging monitor informational
logging buffered warnings
logging trap debugging
logging history warnings
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu dmz1 1500
no failover
no monitor-interface service-module
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
arp rate-limit 16384
nat (inside,outside) source dynamic any interface
!
object network obj_any
nat (any,outside) dynamic interface
access-group outside_access_in in interface outside
access-group inside_access_out in interface inside
route outside 0.0.0.0 0.0.0.0 110.97.188.5 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
timeout conn-holddown 0:00:15
timeout igp stale-route 0:01:10
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication enable console LOCAL
aaa authentication http console LOCAL
aaa authentication login-history
http server enable
http Net-ny2-NETWORK 255.255.255.240 inside
http Net-ny2-SERVERS 255.255.255.0 inside
no snmp-server location
no snmp-server contact
service sw-reset-button
crypto ipsec security-association pmtu-aging infinite
crypto ca trustpool policy
telnet timeout 5
ssh stricthostkeycheck
ssh Net-ny2-NETWORK 255.255.255.240 inside
ssh timeout 5
ssh version 2
ssh key-exchange group dh-group1-sha1
console timeout 0
dhcpd dns 8.8.8.8 8.8.4.4
dhcpd lease 86400
dhcpd auto_config outside
!
dhcpd address 192.168.168.70-192.168.168.74 inside
dhcpd enable inside
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
dynamic-access-policy-record DfltAccessPolicy
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
no tcp-inspection
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
inspect icmp
!
service-policy global_policy global

[Georg Pauwen]

Hello,

to be honest, I don't see how your ISP is recognizing (tagged) traffic from Vlan 15. Does the ISP require traffic to come from Vlan 15 ?

interface GigabitEthernet1/1.15
description to outside
vlan 15
nameif outside
security-level 10
ip address 110.97.188.6 255.255.255.252

[jimmlegs]

No my ISP is not expecting any VLAN tagging, does this mean it is impossible to configure a subinterface as your primary outside connection? I’ve updated to VLAN 1 but get the same results.

Thanks

[jimmlegs]

The packets are not reaching my ISP, the ASA is dropping the packets.

sh int g1/1.15
Interface GigabitEthernet1/1.15 "outside", is up, line protocol is up
Hardware is Accelerator rev01, BW 1000 Mbps, DLY 10 usec
VLAN identifier 15
Description: to outside
MAC address 6c8b.d322.6946, MTU 1500
IP address 110.97.188.6, subnet mask 255.255.255.252
Traffic Statistics for "outside":
5 packets input, 200 bytes
71 packets output, 1988 bytes
5 packets dropped

packet-tracer input outside tcp 110.97.188.6 12345 8.8.8.8 80 detailed

Phase: 1
Type: ROUTE-LOOKUP
Subtype: Resolve Egress Interface
Result: ALLOW
Config:
Additional Information:
found next-hop 110.97.188.5 using egress ifc outside

Phase: 2
Type: ACCESS-LIST
Subtype:
Result: DROP
Config:
Implicit Rule
Additional Information:
Forward Flow based lookup yields rule:
in id=0x7fc1c2a11460, priority=501, domain=permit, deny=true
hits=3, user_data=0x7, cs_id=0x0, reverse, flags=0x0, protocol=0
src ip/id=110.97.188.6, mask=255.255.255.255, port=0, tag=any
dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, tag=any, dscp=0x0
input_ifc=outside, output_ifc=any

Result:
input-interface: outside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

[Georg Pauwen]

Hello,

I have never seen it. Your ISP would need to deal with Vlans and tagged and untagged traffic, I doubt they would want your Vlan 1 in theirs. Why do you want to use a Vlan at all for your outside ?

[jimmlegs]

So it is impossible due to the VLAN assignment requirement of subinterfaces? I cannot name the interface without a VLAN

[Georg Pauwen · Accepted solution]

Hello,

I don't see how this is going to work. Subinterfaces on your side would require a trunk and/or subinterfaces on the ISP side. Why do you need to put the DMZ on the same physical interface ?

---

@jimmlegs wrote:

So it is impossible due to the VLAN assignment requirement of subinterfaces? I cannot name the interface without a VLAN

---

wo

[jimmlegs]

OK thanks