Internal network cannot reach internet router

[ivanlaszik]

Hello!

I have the following problem:
Internal network cannot contact a specific network device, Vodafone Gigacube (Huawei B528), connected to another ASA interface.

My Setup:
One Cisco ASA 5512
One ASA interface (1) used for internal network with IP range 192.168.1.0/24. Between ASA and the devices there is a switch
One ASA interface (0) used for main internet connection from a Fritzbox Fiber Router. Between ASA and Fritzbox is a private network with IP range 192.168.178.0/24
One ASA interface (2) planned for backup internet connection from the Vodafone Gigacube. Between ASA and Gigacube is a private network with IP range 192.168.8.0/24

The gigacubes static IP on its LAN port is 192.168.8.1. It has DHCP server active, so if a laptop is connected directly to it, it will get an IP from range 192.168.8.0

When the gigacube is connected to the ASA, where the used ASA iface has an IP configured from the gigacubes range 192.168.8.2, the gigacube cannot be contacted from the internal network 192.168.1.0.

The ASA itself can ping the gigacube, it also appears in the ARP table with the correct MAC.

The internal network has no firewall access rules to block traffic to any local networks of the ASA. The Fritzbox can be reached from the internal network. If a laptop is connected to the ASA iface used for the gigacube, with IP from 192.168.8.0, it can be reached from the internal network. Only the gigacube cannot be reached.

What is so special about this device? What must I configure to make this work? I believe that until the internal network cannot reach this device it won't be usable for internet access, right?

Thanks.

[ngkin2010]

Hi,

You have demonstrated that ASA is working for your PC, but not working for gigacube.

It may because for PC, it obtained default gateway from your ASA via DHCP. Thus, your PC will reply to 192.168.1.0/24 via the default gateway.

However, for gigacube, I assume it should have a default route to the Internet by itself. And if there is no static route (192.18.1.0/24) configured on gigacube, it will then reply all traffic to 192.168.1.0/24 over the Internet by default route.

So, kindly have a look on gigacube if you have access on it.

[ivanlaszik]

Unfortunatly, for now I have no access to the gigacube.

There is no DHCP Server active on any ASA interface. All of them are manually configured by me.

For the laptop connected to the ASA gigacube interface I set manually the IP (192.168.8.1 with gw=192.168.8.2 (=ASA gigacube iface IP)), trying to simulate the gigacube.

When the fritzbox was setup also by me, i did not have to change any network config in it. I just assigned the ASA port an IP from the Fritzbox's range, 192.168.178.0, and the internal network could reach it. I assumed that because both (fritzbox and gigacube) are routers, they work the same for the private network connected to them. On the ASA there is however a static route on the fritzbox interface saying 0.0.0.0 with mask 0.0.0.0 gw=fritzbox IP with metric 1. So I tried to create another one for the gigacube iface gw being the gigacube IP and set metric 2. This did not help.

So a static route on the gigacube saying to use gw the ASA port IP for the internal network range should do the job?

Why was this not needed for the fritzbox?

What if the gigacube management interface does not allow static routes?

[ngkin2010]

Hi,

I am a bit confused to your topology. Please correct me if I am wrong.

Your ASA configured 192.168.8.2/24, Gigacube configured 192.168.8.1/24, your client connected to Gigacube will obtains IP address 192.168.8.0/24 with gateway set to 192.168.8.1.

On Gigacube, no routing is configured. So the only route is the directed connecred route (192.168.8.0/24) & default route via WAN/the Internet (0.0.0.0/0).

If that's the case, then:

So a static route on the gigacube saying to use gw the ASA port IP for the internal network range should do the job?

Yes, that's make sense. Otherwise, Gigacube don't know how to route your traffic to 192.168.1.0/24

Why was this not needed for the fritzbox?

That's interesting, unless you have enabled source NAT on ASA (e.g. NAT overload), it should not work. But I don't have experience on Fritzbox, not sure it's has any special feature so that it know how to route 192.168.1.0/24. 

What if the gigacube management interface does not allow static routes?

 Is your Gigacube act as a layer 3 router or layer 2 switch?

192.168.8.2 is Gigacube's management IP? is it a OOB or In-band management IP?

[ivanlaszik]

ASA iface to which I connect the gigacube has IP 192.168.8.2/24 (configured manually by me).

Gigacube has only one ethernet port and WLAN. The gigacube always has its own IP 192.168.8.1/24, regardless if connected by ethernet or WLAN, and it sets gw as 192.168.8.1 on the connected device via DHCP.

With gigacube management interface I ment the WebUI of the gigacube to configure it. Currently I do not have access to it, so I do not know if it can do static routes. I am however sure the private IP range can be changed. Regarding the Fritzbox, as said, that one worked right after connecting it to the ASA, I did not touch any of its configurations, except just to expose the ASA to the internet to be able to come in. It could be that the Fritzbox is smarter than the Gigacube, because the one that I have is advertised as a business router. It is a business line.

Is your Gigacube act as a layer 3 router or layer 2 switch?

I don't know how to answer this. Its the default from Vodafone, plug it in and surf away.

Where do I check if source NAT is enabled on ASA? Probably I did not touch this.

I am thinking if the gigacube cannot do static routes, then maybe change its IP so that it is in the internal network. Can it then be used for internet access by the devices on the internal network?
Alternatively connect a simple small router between gigacube and ASA which could do static routes? This would introduce however a new point of failure, and maybe complicate the setup?

[ngkin2010]

Hi,

I am not quite familiar with your Gigacube, so I would wait your checking result of Gigacube.

But just in case adding static route on is not an option. You could consider setup source/static NAT on ASA.

For example, if your server on 192.168.1.0/24 is 192.168.1.100/24 (nameif = internal)
if client on 192.168.8.0/24 is 192.168.8.X (nameif = Gigacube)

nat (internal, Gigacube) source static 192.168.1.100 192.168.8.Y

so, you client on 192.168.8.X can access to 192.168.8.Y which will then translate to 192.168.1.100.

**What you have to make sure is, 192.168.8.Y will not assigned to any client by Gigacube.

If you only need 1-way communication (e.g. from 192.168.1.0/24 to 192.168.8.0/24 and/or 0.0.0.0/0) only. then NAT overload is enough

nat (internal, Gigacube) source dynamic any interface

[ivanlaszik]

so i managed to get access to the configuration of the gigacube. there is no option to set static routes.

the two ASA nat configurations you mentioned also did not help.

[ivanlaszik]

after reading some more on the vodafone community it seems this gigacube is designed to not be usable with switches or other networking devices.

so it seems this is not a cisco asa topic, thus thank you all for your suggestions.

[Georg Pauwen]

Hello,

what if you configure th interface on the ASA that connects to the Gigacube with:

ip address dhcp setroute

[ivanlaszik]

Would this configuration harm the main internet connection? Because I thought about it, but have no experience with it.
I need to know this because the location of the infrastructure is far away from me, and it is a production environment.

Internet connection cannot break. There is also no qualified staff onsite to help fix any outage.

[Georg Pauwen]

Hello,

it will add a static route towards the Gigacube. What kind of routing to do you have configured now towards the Gigacube ?

e.g. route Gigacube 0.0.0.0 0.0.0.0 192.168.8.1

[ivanlaszik]

There is already a 0.0.0.0/0 route on the fritzbox iface to the fritzbox IP. This is the default on ASA set by me when I set up the location.

Your suggested command errors saying that such a route already exists.

If I add the 0.0.0.0/0 route to the gigacube iface with metric 2 it will get added but internal network still cannot talk to the gigacube.

The routing table has following entry:

C 192.168.8.0 255.255.255.0 is directly connected, gigacube

[Georg Pauwen]

If you add the static route, does it show up in the routing table as an 'S' route (show route) ?

[Georg Pauwen]

On a side note, you cannot have two default routes with the same metric. Only one will get installed. I would test this after hours, and add only the static route to the Gigacube.