Hi there
For one of my Clients I need to setup a network VLAN configuration which exists of an ASA 5505 (security plus license) and a cisco catalyst 2960
I already setup one of the ports of my ASA as trunk and did the same for my catalyst. Now here is my problem. Somehow I don't have intervlan connections. I cannot ping one host from VLAN 1 in VLAN 10 or vice versa. From the console of my switch and ASA however I can ping both my hosts in VLAN 10 and/or VLAN 1 (I left out what's not important concerning trunk setup) For now I only placed one switch port in VLAN 10, all other ports -except for the trunk port and the vlan 10 switch port- are member of Native VLAN 1
I think I'm close but something must be missing in my config. Any help is greatly appreciated. Here's my current setup.
ASA 5505:
ASA Version 7.2(4)
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.100.248 255.255.255.0
!
interface Vlan2
nameif outside
security-level 0
ip address X.X.X.X 255.255.255.248
!
interface Vlan3
shutdown
nameif dmz
security-level 50
ip address 192.168.25.254 255.255.255.0
management-only
!
interface Vlan10
nameif voip
security-level 100
ip address 10.10.10.254 255.255.255.0
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
switchport trunk allowed vlan 1,10
switchport trunk native vlan 1
switchport mode trunk
speed 100
duplex full
!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
clock timezone BOT -4
dns server-group DefaultDNS
domain-name yrausquin.local
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
access-list acl_out extended permit gre any interface outside
access-list acl_out extended permit tcp any interface outside eq pptp
access-list acl_out extended permit tcp any interface outside eq https
access-list acl_out extended permit tcp any interface outside eq www
access-list acl_out extended permit tcp any interface outside eq smtp
access-list acl_out extended permit tcp any interface outside eq 995
pager lines 24
logging enable
logging asdm informational
mtu inside 1500
mtu outside 1500
mtu dmz 1500
mtu voip 1500
ip verify reverse-path interface outside
no failover
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 1 192.168.100.0 255.255.255.0
nat (voip) 1 10.10.10.0 255.255.255.0
static (inside,outside) tcp interface https 192.168.100.6 https netmask 255.255.255.255
static (inside,outside) tcp interface www 192.168.100.6 www netmask 255.255.255.255
static (inside,outside) tcp interface smtp 192.168.100.6 smtp netmask 255.255.255.255
static (inside,outside) tcp interface pptp 192.168.100.4 pptp netmask 255.255.255.255
static (inside,outside) tcp interface 995 192.168.100.6 995 netmask 255.255.255.255
access-group acl_out in interface outside
route outside 0.0.0.0 0.0.0.0 201.229.36.17 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.100.5 255.255.255.255 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
sysopt noproxyarp inside
telnet 192.168.100.0 255.255.255.0 inside
telnet timeout 15
!
console timeout 0
username itzupport password PkYOuWGiZUe1KFVX encrypted
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
inspect pptp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:80f67be57b3b5dd872601a654635365b
: end
[OK]
SWITCH 2960:
version 12.2
!
!
!
no file verify auto
!
spanning-tree mode pvst
spanning-tree extend system-id
no spanning-tree vlan 1
!
vlan internal allocation policy ascending
vlan 10
name voip
!
!
interface GigabitEthernet0/12
description Port configured as trunk
switchport trunk allowed vlan 1,10
switchport mode trunk
carrier-delay msec 0
speed 100
duplex full
interface Vlan1
ip address 192.168.100.251 255.255.255.0
no ip route-cache
!
interface Vlan10
ip address 10.10.10.253 255.255.255.0
no ip route-cache
!
end
