Connecting Three Networks.... - Page 3

woodjl1650 · ‎09-12-2011

Seems like I spend more and more time in here (Cisco Forums)....

I was talking to a guy today that was trying to help me link my three networks together, so each is sperate but able to talk to each other. Right now I have them all connect via my ASA, but not able to ping or talk to any of the. He mention that I could connect them all via a switch and then they should work.

I am new to this world, and having a hard time trying to figure out how to accomplish this.

Right now my network is as follows:

Like I stated before, I want to keep each network seperate, but want to be able to access each device no matter what network I am on.

Please HELP!!!

I have extra equipment if needed (old but the work)... Cisco 3660, Cisco 2600, Cisco 2900XL, Netgear FS518

Thanks in advance...

woodjl1650 · ‎09-16-2011

Alright, packet tracer went through, so you think I could ping and connect to the other network.....but I can't...From the ASA CL no ping reply, from Windows no ping reply.....I try to access a device on the other network and no access.

Here is the packet tracer:

Phase: 1

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8e544d0, priority=1, domain=permit, deny=false

hits=1342, user_data=0x0, cs_id=0x0, l3_type=0x8

src mac=0000.0000.0000, mask=0000.0000.0000

dst mac=0000.0000.0000, mask=0100.0000.0000

input_ifc=inside, output_ifc=any

Phase: 2

Type: ROUTE-LOOKUP

Subtype: input

Result: ALLOW

Config:

Additional Information:

in 192.168.2.0 255.255.255.0 inside

Phase: 3

Type: ACCESS-LIST

Subtype:

Result: ALLOW

Config:

Implicit Rule

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8be0040, priority=3, domain=permit, deny=false

hits=5, user_data=0x0, cs_id=0x0, flags=0x4000, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=inside

Phase: 4

Type: IP-OPTIONS

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8b3d6c8, priority=0, domain=inspect-ip-options, deny=true

hits=280, user_data=0x0, cs_id=0x0, reverse, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 5

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

class-map inspection_default

match default-inspection-traffic

policy-map global_policy

class inspection_default

inspect icmp

service-policy global_policy global

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8e19810, priority=70, domain=inspect-icmp, deny=false

hits=5, user_data=0xd88e8248, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 6

Type: INSPECT

Subtype: np-inspect

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8b3d238, priority=66, domain=inspect-icmp-error, deny=false

hits=5, user_data=0xd8b3d120, cs_id=0x0, use_real_addr, flags=0x0, protocol=1

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 7

Type: HOST-LIMIT

Subtype:

Result: ALLOW

Config:

Additional Information:

Forward Flow based lookup yields rule:

in id=0xd8b23ac0, priority=0, domain=host-limit, deny=false

hits=161, user_data=0x0, cs_id=0x0, flags=0x0, protocol=0

src ip/id=0.0.0.0, mask=0.0.0.0, port=0

dst ip/id=0.0.0.0, mask=0.0.0.0, port=0, dscp=0x0

input_ifc=inside, output_ifc=any

Phase: 8

Type: FLOW-CREATION

Subtype:

Result: ALLOW

Config:

Additional Information:

New flow created with id 43028, packet dispatched to next module

Module information for forward flow ...

snp_fp_tracer_drop

snp_fp_inspect_ip_options

snp_fp_inspect_icmp

snp_fp_adjacency

snp_fp_fragment

snp_ifc_stat

Module information for reverse flow ...

Result:

input-interface: inside

input-status: up

input-line-status: up

output-interface: inside

output-status: up

output-line-status: up

Action: allow

And the current config:

ASA Version 8.4(1)

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

ftp mode passive

same-security-traffic permit intra-interface

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network obj_inside

subnet 192.168.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network obj_any

nat (inside,outside) dynamic interface

object network obj_inside

nat (inside,inside) dynamic interface

route outside 0.0.0.0 0.0.0.0 68.108.9.1 1

route inside 192.168.2.0 255.255.255.0 192.168.1.5 1

route inside 192.168.3.0 255.255.255.0 192.168.1.2 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.1.5-192.168.1.36 inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum client auto

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect ip-options

inspect icmp

!

service-policy global_policy global

prompt hostname context

Cryptochecksum:15efd4c561bc04c159b451edef9aa17a

: end

cadet alain · ‎09-16-2011

Hi,

how is the routing configured on the routers? Have you tried pings from routers to hosts. what about a tracert from host to ASA?

Regards.

Alain.

Don't forget to rate helpful posts.

woodjl1650 · ‎09-16-2011

After all this, I think that is the problem...I've looked through every menu on the routers (Belkin n750 & Cisco WRT-310N) and I can find how to add routes or even see the routing table, except for on WRT....but I can't add any routes to it, everytime I try, I get an error. It refuses to take any additional routes.This is the routing table on the WRT. I can't find the table for the Belkin.

192.168.2.0 255.255.255.0 192.168.2.1

192.168.1.0 255.255.255.0 192.168.1.1

0.0.0.0 .0.0.0.0 192.168.1.1

Do you think this is the problem?

cadet alain · ‎09-16-2011

Hi,

Now indeed it must be the problem as the ASA seems to be fine.

192.168.2.0 255.255.255.0 192.168.2.1

192.168.1.0 255.255.255.0 192.168.1.1

0.0.0.0 .0.0.0.0 192.168.1.1

What is the Belkin subnet ? it is the 2.0 subnet so it has a default route pointing to ASA ? if so then it should work between 2.1 and ASA 1.1 .

Try this ping 2.1 from ASA 1.1

Alain.

Don't forget to rate helpful posts.

woodjl1650 · ‎09-16-2011

Still nothing, could I try this?

Belkin = 192.168.3.1 DHCP Scope 192.168.3.5 - 192.168.3.20

WRT-310= 192.168.3.2 DHCP Scope 192.168.3.25 - 192.168.3.45

Keep the subnet kinda the same, just slpit the scope between the two routers? All I am trying to do, is reduce the load off on router and put it on another. the WRT-310 has IP Security Cameras that a constantly on and recording, there is one that is wireless and hogging the bandwidth for the rest of my wireless devices. I want to put those on a different router, but still have access to them from the other computers on the second network.....

I would like to thank you so much for your help, and taking the time to walk me through the process, I learn a lot....thanks agian.

cadet alain · ‎09-16-2011

Hi,

before still making a change I would try to find out why it is not working.

You can ping the ip address of connected router but not the ip address of the subnet just behind?

do a traceroute from ASA to this ip address and also from a host on the 192.168.2.0/24 subnet do a tracert to 192.168.1.1(the ASA ip address).

post the results here.

Regards.

Alain.

Don't forget to rate helpful posts.

woodjl1650 · ‎09-16-2011

Not sure what happened, but I didn't change a thing and all the sudden I can talk from 192.168.2.1 to 192.168.3.1....but I can't talk to the .2.1 from the .3.1.......

cadet alain · ‎09-17-2011

Hi,

I can talk from 192.168.2.1 to 192.168.3.1....but I can't talk to the .2.1 from the .3.1

Isn't this a little contradictory?

Surely the arp cache on routers had still old values but I don't know the arp cache timeout on these routers nor if we can clear it manually or even view it.To know the timeout you'd have to sniff from the router to a host an search for arp requests from router and look at the timestamps between the 2 requests.

So what can you do and not do ? It could also be arp on the ASA? You can do clear arp in privileged mode.

Regards.

Alain.

Don't forget to rate helpful posts.

woodjl1650 · ‎09-17-2011

I found the problem....it's the Belkin Router....I ordered another WRT-310 since that is working well now, just going to copy the same config over when it gets here. Tracert from the 2.1 network goes through without a problem, but when I do it from the 3.1 side, nothing get through. No route option is what Belkin told me.

Anyway, once the other router gets here, I think the problem will be solved. Thanks again for your help.

One last question, my running config will not save. I do a write mem, but if I reload, nothing is save, it reverts back to default config....any ideas?

cadet alain · ‎09-17-2011

Hi,

verify the config-register value with sh version, it should be 0x1 and try copy run start instead of wr mem.

Let us know.

Regards.

Alain.

Don't forget to rate helpful posts.