Cannot Upload files between Vlan +ASA Firewall

[Manojy]

Hello,

We have set up separate VLANs for phones and data, with the phone VLAN2 and Data on a native VLAN. I am able to access the phones and UCM IPPBX GUI from the native VLAN, which is on my 192.168.0.0 subnet, to the voice VLAN, which is on the 192.168.70.0 subnet.

Before separating the VLANs, I was able to upload firmware on our IP phones, but after isolating the voice VLAN, I am unable to do so. We have an ASA firewall with two interfaces, one on the 192.168.0.0 and the second one for voice on the 192.168.70.0 subnet. The security levels are the same, and I am able to ping and access the GUI of phones and IPPBX.

Are there any extra commands that I need to add to enable traffic from one subnet to another for uploading the firmware?

Snapshot of the Phone and uploading path attached.

Please assist and advise.

[myabrownn876]

To enable firmware uploads from your native VLAN to the voice VLAN, consider checking the ASA firewall rules. Ensure that traffic is allowed between the subnets 192.168.0.0 and 192.168.70.0 specifically for the port used during firmware uploads.

If the firewall settings are confirmed, you might also want to verify any network ACLs or VLAN access restrictions that could be affecting the firmware upload path.

[Manojy]

There are currently no restrictions set between the two subnets, but the only restriction is that NAT is not allowed for IP phones outside the network. The UCM uses port 8090, however, it is currently not possible to see the HTTP port for the Grandstream phones via web browser. The acl is also applied from any to any.I have reached out to the help desk team to inquire if there are any available ports. I am waiting for their response.

[paul driver]

Hello
where is the source of the http connection originating from - internal or external

can you post the run cfg of the asa?
I assume this is the same topology from your last OP correct!

[Manojy]

where is the source of the http connection originating from - Internal

can you post the run cfg of the asa? sure will do
I assume this is the same topology from your last OP correct! yes

i am trying to upgrade the firmware of the phones from my pc which is on 192.168.0.0 subnet.i am able to access the phones GUI from my pc and when i click upload the firmware located at my computer folder nothing happens..but before isolating the vlan for voice i was able to do that because vlan was not in the picture.

Native Vlan 192.168.0.0  Voice Vlan 192.168.70.0

Regards

Manoj

[Manojy]

Pls find asa Config as you requested

[MHM Cisco World]

you apply access list  (only allow ICMP) to direction IN to both Inside and IPPhone interface, 
this ACL will override same secuirty level permit intra/inter interface 
so you need to allow HTTP to make client can access server. 
or try permit ip any any first to check if ACL is source of issue 

MHM

[MHM Cisco World]

Hi friend again 
so you have success ping but the HTTP is not allow ?
MHM

[Manojy]

Yes i ahve success ping from ASA and ping from inside subnet to Voice Vlan

I enabled Http server but still same issue.

I have attached my asa config.pls find below.

[MHM Cisco World]

ASA# packet-tracer input ipphone tcp <ip of ipphone host>1025 (ip of inside server) 443 detailed 

Share output of above 

MHM

[Manojy]

Hello,

Please find attached the input from the packet tracer.

Regards

Manoj

[gpbox60]

If you've already verified connectivity and access to devices and interfaces across VLANs, and the firewall settings seem appropriate, there might be a specific issue causing the firmware upload problem. Here are some additional steps you can consider:

1. **Firmware Server Access:** Ensure that the server hosting the firmware files is accessible from the voice VLAN (192.168.70.0 subnet). Check the firewall rules to ensure that traffic to and from the server is allowed.

2. **TFTP/FTP Configuration:** Confirm that the TFTP or FTP service being used for firmware uploads is configured to accept connections from devices on the voice VLAN. Check firewall rules and server settings to ensure they permit access from the voice subnet.

3. **ACL Configuration:** Review the Access Control Lists (ACLs) on the ASA firewall. Ensure that there are no specific rules or deny statements blocking the traffic required for firmware uploads between the VLANs.

4. **ASA Packet Tracer:** Use the ASA Packet Tracer feature to simulate traffic between the VLANs and identify any rules or policies that might be blocking the firmware upload traffic. This can help pinpoint where the issue lies.

5. **Logging and Monitoring:** Enable logging on the ASA firewall to monitor traffic between the VLANs. Check the logs for any denied traffic attempts during the firmware upload process. This can provide insights into why the upload is failing.

6. **ASA Configuration Review:** Double-check the ASA firewall configuration for any implicit deny statements that might be restricting traffic between the VLANs. Ensure that appropriate access rules are in place for traffic required for firmware uploads.

If everything seems configured correctly and you still encounter issues, examining logs, using packet tracer, and possibly involving network specialists or contacting ASA support might help in identifying and resolving the problem.

[paul driver]

Hello
TBH - I dont see anything that stands out on the ASA negating http access between vlans, can you run a PT and share the results please.

ASA

packet-tracer input inside tcp 192.168.0.x http 192.168.70.x http 

[Manojy]

Hi,

Please find attached the inputs from the packet tracer.

Regards

Manoj

[MHM Cisco World]

ASA# capture capin interface inside match ip host <server IP>
Asa#show capture 
Connect to server and wait then
Asa#no capture capin

 Share results here

MHM