ASA 5545 & L3 configuration help

[sachinc01]

Hi,

Please read following configuration & Issue & please help to resolve this.(Network Structure Router to ASA to L3 Switch) 

Router 3945

R1 WAN 10.84.35.202/30
R1 LAN 10.84.35.211/28 (Primary router)

ASA (5545):-10.84.35.210/28 Outside
                   10.84.35.65/26 Inside
                  Default route for 0.0.0.0 0.0.0.0 10.84.35.211

L3:- L3 VLAN on Switch
Vlan 2 10.84.32.1/23
Vlan 3 10.84.34.1/24
Vlan 4 10.84.35.1/26
VLAN 5 10.84.35.65/26

In this case from ASA i will be reach to router (35.211 & 202) & switch (10.84.35.66)
From router able to reach ASA (10.84.35.210) & Switch also able to rech 10.84.35.65

Issue:- From L3 Switch uable to reach 10.84.35.210 (ASA) & router (10.84.35.211 )also

So some can help me what configuration i wil ned to reach ASA outside interface & Router
From L3 Switch....

Sachin

[Georg Pauwen]

Also, can you post the output of 'show ip route' from all three devices ?

[sachinc01]

Hi Sir,

Thanks for support :)

Please find attachment...

[Georg Pauwen]

Hello,

on the firewall, add:

route inside 0 0 10.84.35.65

and on the switch, remove the IP address from the Vlan 4 interface and configure the uplink port to the ASA as following:

interface GigabitEthernet1/0/10
description uplink to ASA
no switchport
ip address 10.84.35.66 255.255.255.192

[sachinc01]

Hi ,

I have try but unable to add route on Firewall

[Georg Pauwen]

Hello, 

it needs to be:

route inside 0 0 10.84.35.66

My mistake, sorry.

If adding the route doesn't help, add the other config bit:

interface GigabitEthernet1/0/10
description uplink to ASA
no switchport
ip address 10.84.35.66 255.255.255.192

[sachinc01]

Hi,

ASA

Ip have add route inside 0 0 10.84.35.66 1

& also make changes done on ASA but not reach ASA outside interface.

Sir,I have one daut I thing routing not work on ASA

I have received attached key with ASA Didi i need to add this key or activated my product if yes please guide me.

[sachinc01]

Please guide its urgent ..

Regards,
Sachin

[Georg Pauwen]

Hello,

what is the output of:

GITFirewall# show activation-key detail

[sachinc01]

Hi sir,

Please see output.

also  please see when I will try traceroute from ASA

#traceroute 10.84.35.66 source outside1 (10.84.35.213 Asa int gi0/1)

Received following log on ASA (See attch lg & lg2)

[Georg Pauwen]

Hello,

the license looks good.

I think the problem is with the 'management-only' command on your interface. Try and remove the 'management-only':

interface GigabitEthernet0/1
description "Connected to R1"
management-only
nameif OUTSIDE1
security-level 0

When the management-only command is enabled under an interface, routing out of that interface is not allowed. In this instance, the interface only accepts direct communication. Traffic cannot pass through it.

[sachinc01]

hi sir,

remove management-only but same issue..

Please see my all config .txt (SW,router ASA)& guide me to resolved on priority.

interface GigabitEthernet0/1
description "Connected to R1"
nameif OUTSIDE1
security-level 0
ip address 10.84.35.213 255.255.255.240

[Georg Pauwen]

Hello,

revert back to the original configuration, the one you had when you originally started this post.

I don't know what the configurations look right now after all the changes. Post all three, the ASA, the router, and the switch, again. I am pretty sure it will work with removing the 'management-only' command, that was the underlying issue to start out with.

[sachinc01]

Hi Sir,

Thanks for response..

Please see  all3 device config.attached Please see this.

& revert ASAP..

Rs,

Sachin

[sachinc01]

Hi sir ,

Please phocas on only ASA & switch not able to reach ASA out side interface from Switch it this will happened then we will able able to reach router....

You will understand issue quickly.

Sachin

[sachinc01]

Hi,

Can any one revert to resolved this issue.