Hello, Everyone.
I am currently trying to setup 2 networks, 192.168.1.0 and 192.168.2.0, so that they can ping each other(and eventually talk to each other). However they are to communicate with each other using firewalls, specifically the ASA 5506-X. Here is the network setup
My goal is to have the ASA0(1)(1) with 192.168.0.3 ip address to act as a default gateway to not only the devices on that LAN(192.168.0.0), but also as a default route for the other 2 ASAs, ASA0(192.168.0.1) and ASA0(1)(192.168.0.2). Here are some notes about the firewalls:
- All of the interfaces in use(GE1/1 and GE1/2) have same security level of 100 and are up('no shut')
- All of the inspect icmp via policy-map global_policy
- Firewalls 192.168.0.1 and 192.168.0.2 have static routes: 'ip route 0.0.0.0 [name of interface connected to switch] 0.0.0.0 192.168.0.3'
And here is the flow of a ping packet from 192.168.1.10 to 192.168.2.10(assuming that enough pings have gone through the firewalls so that there is no ping timeouts and there are actual replies):
Performing a test from 192.168.1.10 to 192.168.2.10
- 192.168.0.1 routes to directly 192.168.0.2 instead of going to 192.168.0.3 first. Then 192.168.0.2 routes the packet to the destination 192.168.2.10
On the return:
- 192.168.0.2 routes directly to 192.168.0.1 instead of going to 192.168.0.3 first. Then 192.168.0.1 routes the packet to the destination 192.168.1.10
Now, if I were to replace all the ASAs with routers(I used 2901 ISR) and give them the static route of 'ip route 0.0.0.0 0.0.0.0 192.168.0.3' and were to observe the flow of the ping packets from 192.168.1.0 to 192.168.2.10, I would actually see the 192.168.0.3 actually being used to route the packets from 192.168.0.1 to 192.168.0.2 and vice versa before the packet reaches their intended destinations.
Further, I have attached the cisco packet tracer file(called 'router vs asa.pkt'), which shows both the network with all ASAs and the network with all ISRs. It is attached as a .zip file since the website won't allow .pkt files. Here is a network of both networks side to side(shown in the file).
I just do not understand what is going on and why it is not working on the 5506-X as it works on the 2901 ISRs. Any help is appreciated and forgive for any misunderstanding of confusion, I am relatively new to networking stuff.
In summary: I am trying to have one router/firewall perform the routing between the other networks via intra interface routing(packet comes out from which it first came from). I first used Cisco 5506-X firewalls with security level 100 + inspect icmp + default route that leads to ASA that is to perform routing to the destination network. That didn't work. But replacing the ASAs with 2901 ISRs did the trick. The question is: What can I do on the ASA for it to work as intended like the ISRs do?
