Strange IP Connectivity

[Farjad Haider]

I configured a lab using the 192.168.0.0/29 subnet on the outside interface of a firewall that is connected to an HSRP setup. Initially, without other devices the subnet works perfectly fine but when i add other configurations and more devices, the subnet suddenly loses connectivity. There are no ACLs applied on the firewall to block connections. The other subnets on the inside interface continue from 192.168.0.0. onwards (Implementing VLSM). 

Interestingly, when I change the outside subnet to 192.168.1.0/29, the connections work perfectly fine.

[balaji.bandi]

Until we see the configuration, we do not what is the wrong here.

guide lines, you can not have same subnet inside and outside overlapping.

[Farjad Haider]

they are not on the same subnet, the inside is on 192.168.0.8/30 and outside is 192.168.0.0/29.
I forgot to mention when I initially assigned the IPs with only the routers and firewall in the topology, everything worked fine, but when i added other devices and other subnets, it lost connectivity. 

[balaji.bandi]

Until we see the configuration, we do not what is the wrong here.

[Farjad Haider]

Primary Router:

interface GigabitEthernet0/0/0

ip address 192.168.1.1 255.255.255.248

duplex auto

speed auto

standby priority 150

standby preempt

standby 1 ip 192.168.1.3

!

interface GigabitEthernet0/0/1

ip address 10.0.0.1 255.255.255.248

duplex auto

speed auto

standby 1 ip 10.0.0.3

standby preempt

!

interface GigabitEthernet0/0/2

no ip address

duplex auto

speed auto

shutdown

!

interface Vlan1

no ip address

shutdown

!

router ospf 1

log-adjacency-changes

redistribute connected subnets

network 10.0.0.0 0.0.0.7 area 0

network 192.168.1.0 0.0.0.7 area 0

!


Firewall:

ciscoasa#sh run

: Saved

:

ASA Version 9.6(1)

!

hostname ciscoasa

names

!

interface GigabitEthernet1/1

nameif outside

security-level 0

ip address 192.168.1.4 255.255.255.248

!

interface GigabitEthernet1/2

nameif inside

security-level 100

ip address 192.168.0.9 255.255.255.252

!

interface GigabitEthernet1/3

nameif DMZ

security-level 50

ip address 192.168.0.25 255.255.255.252

!

interface GigabitEthernet1/4

no nameif

no security-level

no ip address

shutdown

!

interface GigabitEthernet1/5

no nameif

no security-level

no ip address

shutdown

!

interface GigabitEthernet1/6

no nameif

no security-level

no ip address

shutdown

!

interface GigabitEthernet1/7

no nameif

no security-level

no ip address

shutdown

!

interface GigabitEthernet1/8

no nameif

no security-level

no ip address

shutdown

!

interface Management1/1

management-only

no nameif

no security-level

no ip address

shutdown

!

!

!

access-list INSIDE-ACL extended permit ip 192.168.0.32 255.255.255.248 any

access-list INSIDE-ACL extended permit ip 192.168.0.48 255.255.255.240 host 192.168.0.26

access-list INSIDE-ACL extended permit ip 192.168.0.40 255.255.255.248 host 192.168.0.26

access-list INSIDE-ACL extended deny ip 192.168.0.48 255.255.255.240 any

access-list INSIDE-ACL extended deny ip 192.168.0.40 255.255.255.248 any

access-list INSIDE-ACL extended permit ip any any

access-list OUTSIDE-ACL extended permit ip any any

access-list OUTSIDE-ACL extended permit icmp any any

access-list DMZ-ACL extended permit ip any host 192.168.0.26

access-list DMZ-ACL extended deny ip any any

!

!

!

!

class-map inspection_default

match default-inspection-traffic

!

policy-map type inspect dns preset_dns_map

parameters

message-length maximum 512

policy-map global_policy

class inspection_default

inspect dns preset_dns_map

inspect ftp

inspect icmp

inspect tftp

!

service-policy global_policy global

!

telnet timeout 5

ssh timeout 5

!

!

!


ACLs have not been applied yet.

[balaji.bandi]

This configuration somehow helps, but not 100%; we do not have a complete picture of the network.

As per the information firewall, G1/2 Lan side and Gig1/1 Outside to interface ( as per the diagram, is this correct)

I do not see any route in ASA for the outside default route point to HSRP IP 192.168.1.3.

On the router, you are running OSPF. Can you show the IP OSPF ne ? and routing table (show ip route) And is the HSRP working? How does the router know return traffic sent to ASA?