ASA Main Goal Inter Vlan Routing

[WildMan365]

I am trying to get a lab going in gns3. I created 2 subinterfaces (vlan 2 & 3) with the intension of running a cisco switch having one pc on one vlan & one pc on the other. I learned that there are no cisco switches in gns3 (whatever..) Anyway I just created to interfaces with IP addresses (LAN's) and connected 2 pc's directly to the ASA to fulfill my goals. My problem is I cannot ping from pc1 to pc2. Both pc's can ping there own gateways and I added the command....

"same-security-traffic permit intra-interface" which I was lead to believe would allow both networks to talk. I know ASA on gns3 is hit or miss so i've rebooted/started all devices after writing the commands which has not worked. Would appreciate some help. Here is my config...

Mario-Guitar-Shop-HQ# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname Mario-Guitar-Shop-HQ
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
nameif outside
security-level 0
ip address 50.0.0.1 255.255.255.248
!
interface GigabitEthernet1
nameif inside
security-level 100
ip address 10.20.10.1 255.255.255.0
!
interface GigabitEthernet1.2
vlan 2
nameif vlan2
security-level 100
ip address 10.0.0.1 255.255.255.0
!
interface GigabitEthernet1.3
vlan 3
nameif vlan3
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet2
nameif wireless
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet3
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit intra-interface
pager lines 24
mtu outside 1500
mtu inside 1500
mtu vlan2 1500
mtu vlan3 1500
mtu wireless 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 7200
!
dhcpd address 10.20.10.11-10.20.10.100 inside
dhcpd dns 10.20.10.1 interface inside
dhcpd enable inside
!
dhcpd address 192.168.10.10-192.168.10.100 wireless
dhcpd dns 192.168.10.1 interface wireless
dhcpd enable wireless
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:2c391b206dfd8073446c7b05db3d6b73
: end

[Julio E. Moisa · Accepted solution]

Hi

The parent interface should not have any IP addressing or name configured:

interface GigabitEthernet1
nameif inside
security-level 100
ip address 10.20.10.1 255.255.255.0

Now if you are going to use sub-interfaces you need a switch (with a trunk interface) or router (with the same sub interfaces) facing the firewall.

In order to make it work, you need to create ACLs on the firewall, example:

access-list VLAN-2-IN extended permit icmp any any echo

access-list VLAN-2-IN extended permit icmp any any echo-reply

access-list VLAN-2-IN extended permit ip any any 

access-list VLAN-3-IN extended permit icmp any any echo

access-list VLAN-3-IN extended permit icmp any any echo-reply

access-list VLAN-3-IN extended permit ip any any 

Then apply them to the access-group like we do on the routers.

access-group VLAN-2-IN in interface vlan2

access-group VLAN-3-IN in interface vlan3

Remember security level 100 is full protection so you need explicitly allow the access, in few words using ACLs. 

Hope it is useful

:-)

[WildMan365]

Julio are the access rules you listed usually neccesary? Is it hit or miss depending on the ASA version? I am trying to lab this out in GNS3 1.0.3 & had the devices on different vlans pingning each other without the commands. I restarted the lab & I cannot ping. I copy pasted the commands & could not get it to work even closing GNS3 & roopening the program. I know that sometimes ASA 8.4 can be a pain in GNS so im not sure what the problem is. I checked that the config was saved and everything. Im starting to lose faith in ASA8.4/GNS3. The commands you gave seem to make sense to me. They are all Permit Ingress to each vlan.

[Julio E. Moisa]

Hi, 

Could you please share the config again and a picture of your topology?

Thank you

[WildMan365]

Both pc's are able to ping their own gateway. One pc is on vlan 2 the other vlan 3. I also attached the topology. The funny thing is everything was pinging with no access lists/groups & at some point I restarted GNS3 & it never work after that. Thats when I made this post. I reverted back to the config I ran prior to it breaking still notihing. The ASA is doing Qemu from my laptop no VM. I have windows 10 so I'm not sure if the issue is due to my GNS3 setup or maybe the ASA image itself is corrupt. Seems like I can save everything and entering commands have been an issue up to this point. Perhaps im just another horror story running ASA Qemu on Windows 10. I just dont know. I also pasted a copy of the boot up outputs which I do see errors on.

Mario-Guitar-Shop-HQ# sh run
: Saved
:
ASA Version 8.4(2)
!
hostname Mario-Guitar-Shop-HQ
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
!
interface GigabitEthernet0
nameif outside
security-level 0
ip address 50.0.0.1 255.255.255.248
!
interface GigabitEthernet1
nameif inside
security-level 100
ip address 10.20.10.1 255.255.255.0
!
interface GigabitEthernet1.2
vlan 2
nameif vlan2
security-level 100
ip address 10.0.0.1 255.255.255.0
!
interface GigabitEthernet1.3
vlan 3
nameif vlan3
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface GigabitEthernet2
nameif wireless
security-level 100
ip address 192.168.10.1 255.255.255.0
!
interface GigabitEthernet3
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
same-security-traffic permit intra-interface
access-list VLAN-2-IN extended permit icmp any any echo
access-list VLAN-2-IN extended permit icmp any any echo-reply
access-list VLAN-2-IN extended permit ip any any
access-list VLAN-3-IN extended permit icmp any any echo
access-list VLAN-3-IN extended permit icmp any any echo-reply
access-list VLAN-3-IN extended permit ip any any
pager lines 24
mtu outside 1500
mtu inside 1500
mtu vlan2 1500
mtu vlan3 1500
mtu wireless 1500
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
access-group VLAN-2-IN in interface vlan2
access-group VLAN-3-IN in interface vlan3
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
user-identity default-domain LOCAL
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd lease 7200
!
dhcpd address 10.20.10.11-10.20.10.100 inside
dhcpd dns 10.20.10.1 interface inside
dhcpd enable inside
!
dhcpd address 192.168.10.10-192.168.10.100 wireless
dhcpd dns 192.168.10.1 interface wireless
dhcpd enable wireless
!
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
!
!
prompt hostname context
no call-home reporting anonymous
call-home
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
crashinfo save disable
Cryptochecksum:454258ae9a77bdf6d523f589a3f1a682
: end
Mario-Guitar-Shop-HQ#

____________________________________________________________________________

Initializing cgroup subsys cpu
Linux version 2.6.29.6 (builders@bld-releng-05a) (gcc version 4.3.4 (crosstool-NG-1.5.0) ) #1 PREEMPT Wed Jun 15 17:19:01 MDT 2011
KERNEL supported cpus:
Intel GenuineIntel
AMD AuthenticAMD
NSC Geode by NSC
Cyrix CyrixInstead
Centaur CentaurHauls
Transmeta GenuineTMx86
Transmeta TransmetaCPU
UMC UMC UMC UMC
BIOS-provided physical RAM map:
BIOS-e820: 0000000000000000 - 000000000009fc00 (usable)
BIOS-e820: 000000000009fc00 - 00000000000a0000 (reserved)
BIOS-e820: 00000000000f0000 - 0000000000100000 (reserved)
BIOS-e820: 0000000000100000 - 000000003ffe0000 (usable)
BIOS-e820: 000000003ffe0000 - 0000000040000000 (reserved)
BIOS-e820: 00000000fffc0000 - 0000000100000000 (reserved)
last_pfn = 0x3ffe0 max_arch_pfn = 0x100000
RAMDISK: 3e985000 - 3ffef637
Allocated new RAMDISK: 003a1000 - 01a0b637
Move RAMDISK from 000000003e985000 - 000000003ffef636 to 003a1000 - 01a0b636
615MB HIGHMEM available.
407MB LOWMEM available.
mapped low ram: 0 - 197fe000
low ram: 00000000 - 197fe000
bootmap 00001000 - 00004300
(7 early reservations) ==> bootmem [0000000000 - 00197fe000]
#0 [0000000000 - 0000001000] BIOS data page ==> [0000000000 - 0000001000]
#1 [0000100000 - 000039ed10] TEXT DATA BSS ==> [0000100000 - 000039ed10]
#2 [000039f000 - 00003a1000] INIT_PG_TABLE ==> [000039f000 - 00003a1000]
#3 [000009fc00 - 0000100000] BIOS reserved ==> [000009fc00 - 0000100000]
#4 [0000007000 - 0000008000] PGTABLE ==> [0000007000 - 0000008000]
#5 [00003a1000 - 0001a0b637] NEW RAMDISK ==> [00003a1000 - 0001a0b637]
#6 [0000001000 - 0000005000] BOOTMAP ==> [0000001000 - 0000005000]
Zone PFN ranges:
DMA 0x00000000 -> 0x00001000
Normal 0x00001000 -> 0x000197fe
HighMem 0x000197fe -> 0x0003ffe0
Movable zone start PFN for each node
early_node_map[2] active PFN ranges
0: 0x00000000 -> 0x0000009f
0: 0x00000100 -> 0x0003ffe0
Allocating PCI resources starting at 50000000 (gap: 40000000:bffc0000)
Built 1 zonelists in Zone order, mobility grouping on. Total pages: 259967
Kernel command line: ide_generic.probe_mask=0x01 ide_core.chs=0.0:980,16,32 auto nousb console=ttyS0,9600 bigphysarea=65536 ide1=noprobe no-hlt
Enabling fast FPU save and restore... done.
Enabling unmasked SIMD FPU exception support... done.
Initializing CPU#0
PID hash table entries: 2048 (order: 11, 8192 bytes)
Fast TSC calibration using PIT
Detected 999.979 MHz processor.
Console: colour dummy device 80x25
console [ttyS0] enabled
Dentry cache hash table entries: 65536 (order: 6, 262144 bytes)
Inode-cache hash table entries: 32768 (order: 5, 131072 bytes)
allocated 5242240 bytes of page_cgroup
please try cgroup_disable=memory option if you don't want
Memory: 745612k/1048448k available (1715k kernel code, 301528k reserved, 623k data, 156k init, 630664k highmem)
virtual kernel memory layout:
fixmap : 0xfffed000 - 0xfffff000 ( 72 kB)
pkmap : 0xff800000 - 0xffc00000 (4096 kB)
vmalloc : 0xf7ffe000 - 0xff7fe000 ( 120 MB)
lowmem : 0xde000000 - 0xf77fe000 ( 407 MB)
.init : 0xde34c000 - 0xde373000 ( 156 kB)
.data : 0xde2acca6 - 0xde348938 ( 623 kB)
.text : 0xde100000 - 0xde2acca6 (1715 kB)
Checking if this processor honours the WP bit even in supervisor mode...Ok.
Calibrating delay loop (skipped), value calculated using timer frequency.. 1999.95 BogoMIPS (lpj=999979)
Security Framework initialized
Mount-cache hash table entries: 512
Initializing cgroup subsys cpuacct
Initializing cgroup subsys memory
CPU: L1 I Cache: 64K (64 bytes/line), D cache 64K (64 bytes/line)
CPU: L2 Cache: 512K (64 bytes/line)
Intel machine check architecture supported.
Intel machine check reporting enabled on CPU#0.
CPU: AMD QEMU Virtual CPU version 2.1.0 stepping 03
Checking 'hlt' instruction... disabled
Freeing SMP alternatives: 0k freed
net_namespace: 668 bytes
NET: Registered protocol family 16
PCI: PCI BIOS revision 2.10 entry at 0xfd456, last bus=0
PCI: Using configuration type 1 for base access
bio: create slab <bio-0> at 0
PCI: Probing PCI hardware
pci 0000:00:01.3: quirk: region 0600-063f claimed by PIIX4 ACPI
pci 0000:00:01.3: quirk: region 0700-070f claimed by PIIX4 SMB
pci 0000:00:01.0: PIIX/ICH IRQ router [8086:7000]
NET: Registered protocol family 2
IP route cache hash table entries: 16384 (order: 4, 65536 bytes)
TCP established hash table entries: 65536 (order: 7, 524288 bytes)
TCP bind hash table entries: 65536 (order: 6, 262144 bytes)
TCP: Hash tables configured (established 65536 bind 65536)
TCP reno registered
NET: Registered protocol family 1
Unpacking initramfs... done
Freeing initrd memory: 22953k freed
platform rtc_cmos: registered platform RTC device (no PNP device found)
Machine check exception polling timer started.
highmem bounce pool size: 64 pages
HugeTLB registered 4 MB page size, pre-allocated 0 pages
bigphysarea: Allocated 65536 pages at 0xe0400000.
msgmni has been set to 271
io scheduler noop registered
io scheduler anticipatory registered (default)
io scheduler deadline registered
io scheduler cfq registered
pci 0000:00:00.0: Limiting direct PCI/PCI transfers
pci 0000:00:01.0: PIIX3: Enabling Passive Release
pci 0000:00:01.0: Activating ISA DMA hang workarounds
Serial: 8250/16550 driver, 4 ports, IRQ sharing disabled
serial8250: ttyS0 at I/O 0x3f8 (irq = 4) is a 16550A
loop: module loaded
pcnet32.c:v1.35 21.Apr.2008 tsbogend@alpha.franken.de
tun: Universal TUN/TAP device driver, 1.6
tun: (C) 1999-2004 Max Krasnyansky <maxk@qualcomm.com>
Uniform Multi-Platform E-IDE driver
ide_generic: enforcing probing of I/O ports upon user request
ide: forcing hda as a disk (980/16/32)
hda: QEMU HARDDISK, ATA DISK drive
ide0 at 0x1f0-0x1f7,0x3f6 on irq 14
ide-gd driver 1.18
hda: max request size: 512KiB
hda: 1048576 sectors (536 MB) w/256KiB Cache, CHS=980/16/32
hda: cache flushes supported
hda: hda1
TCP cubic registered
NET: Registered protocol family 17
RPC: Registered udp transport module.
RPC: Registered tcp transport module.
802.1Q VLAN Support v1.8 Ben Greear <greearb@candelatech.com>
All bugs added by David S. Miller <davem@redhat.com>
TIPC: Activated (version 1.6.4 compiled Jun 15 2011 17:18:15)
NET: Registered protocol family 30
TIPC: Started in single node mode
Using IPI Shortcut mode
Freeing unused kernel memory: 156k freed
Write protecting the kernel text: 1716k
Write protecting the kernel read-only data: 504k
Starting kernel event manager...
Loading hardware drivers...
Intel(R) PRO/1000 Network Driver - version 7.3.21-k3-NAPI
Copyright (c) 1999-2006 Intel Corporation.
e1000 0000:00:03.0: found PCI INT A -> IRQ 11
e1000: 0000:00:03.0: e1000_probe: (PCI:33MHz:32-bit) 00:00:ab:28:f5:00
e1000: eth0: e1000_probe: Intel(R) PRO/1000 Network Connection
e1000 0000:00:04.0: found PCI INT A -> IRQ 11
e1000: 0000:00:04.0: e1000_probe: (PCI:33MHz:32-bit) 00:00:ab:cc:5e:01
e1000: eth1: e1000_probe: Intel(R) PRO/1000 Network Connection
e1000 0000:00:05.0: found PCI INT A -> IRQ 10
pci 0000:00:01.3: IRQ routing conflict: have IRQ 9, want IRQ 10
e1000: 0000:00:05.0: e1000_probe: (PCI:33MHz:32-bit) 00:00:ab:7d:2c:02
e1000: eth2: e1000_probe: Intel(R) PRO/1000 Network Connection
e1000 0000:00:06.0: found PCI INT A -> IRQ 10
e1000: 0000:00:06.0: e1000_probe: (PCI:33MHz:32-bit) 00:00:ab:1d:4f:03
e1000: eth3: e1000_probe: Intel(R) PRO/1000 Network Connection
e100: Intel(R) PRO/100 Network Driver, 3.5.23-k6-NAPI
e100: Copyright(c) 1999-2006 Intel Corporation
loaded.
Initializing random number generator... done.
Starting network...
device eth0 entered promiscuous mode
device eth1 entered promiscuous mode
device eth2 entered promiscuous mode
device eth3 entered promiscuous mode
e1000: eth0 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
e1000: eth1 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
e1000: eth2 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
e1000: eth3 NIC Link is Up 1000 Mbps Full Duplex, Flow Control: RX
dosfsck 2.11, 12 Mar 2005, FAT32, LFN
Starting check/repair pass.
Starting verification pass.
/dev/hda1: 128 files, 100/65499 clusters
dosfsck(/dev/hda1) returned 0
FAT: "posix" option is obsolete, not supported now
TIPC: Started in network mode
TIPC: Own node address <1.1.1>, network identity 1234
TIPC: Enabled bearer <eth:tap0>, discovery domain <1.1.0>, priority 10
msrif: module license 'Cisco Systems, Inc' taints kernel.
msrif module loaded.
Clocksource tsc unstable (delta = 132008317 ns)
Starting Likewise Service Manager
Processor memory 650117120, Reserved memory: 62914560
WARNING: LINA Monitor notification queue not created
No such file or directory
IMAGE ERROR: An error occurred when reading the controller type

Total NICs found: 4
secstore_buf_fill: Error reading secure store - buffer 0xddfffb18, size 0x14
key_nv_init: read returned error 1, len 129
L4TM: Unknown ASA Model
Verify the activation-key, it might take a while...
Running Permanent Activation Key: 0xb23bcf4a 0x1c713b4f 0x7d53bcbc 0xc4f8d09c 0x0e24c6b6

Licensed features for this platform:
Maximum Physical Interfaces : Unlimited perpetual
Maximum VLANs : 100 perpetual
Inside Hosts : Unlimited perpetual
Failover : Active/Active perpetual
VPN-DES : Enabled perpetual
VPN-3DES-AES : Enabled perpetual
Security Contexts : 5 perpetual
GTP/GPRS : Disabled perpetual
AnyConnect Premium Peers : 25 perpetual
AnyConnect Essentials : Disabled perpetual
Other VPN Peers : 5000 perpetual
Total VPN Peers : 0 perpetual
Shared License : Enabled perpetual
AnyConnect for Mobile : Disabled perpetual
AnyConnect for Cisco VPN Phone : Disabled perpetual
Advanced Endpoint Assessment : Enabled perpetual
UC Phone Proxy Sessions : 10 perpetual
Total UC Proxy Sessions : 10 perpetual
Botnet Traffic Filter : Enabled perpetual
Intercompany Media Engine : Enabled perpetual

This platform has an ASA 5520 VPN Plus license.

Cisco Adaptive Security Appliance Software Version 8.4(2)
_le_open: fd:4, name:eth0
---Device eth0 (fd: 4) opened succesful!
_le_open: fd:8, name:eth1
---Device eth1 (fd: 8) opened succesful!
_le_open: fd:9, name:eth2
---Device eth2 (fd: 9) opened succesful!
_le_open: fd:10, name:eth3
---Device eth3 (fd: 10) opened succesful!

****************************** Warning *******************************
This product contains cryptographic features and is
subject to United States and local country laws
governing, import, export, transfer, and use.
Delivery of Cisco cryptographic products does not
imply third-party authority to import, export,
distribute, or use encryption. Importers, exporters,
distributors and users are responsible for compliance
with U.S. and local country laws. By using this
product you agree to comply with applicable laws and
regulations. If you are unable to comply with U.S.
and local laws, return the enclosed items immediately.

A summary of U.S. laws governing Cisco cryptographic
products may be found at:
http://www.cisco.com/wwl/export/crypto/tool/stqrg.html

If you require further assistance please contact us by
sending email to export@cisco.com.
******************************* Warning *******************************

Copyright (c) 1996-2011 by Cisco Systems, Inc.

Restricted Rights Legend

Use, duplication, or disclosure by the Government is
subject to restrictions as set forth in subparagraph
(c) of the Commercial Computer Software - Restricted
Rights clause at FAR sec. 52.227-19 and subparagraph
(c) (1) (ii) of the Rights in Technical Data and Computer
Software clause at DFARS sec. 252.227-7013.

Cisco Systems, Inc.
170 West Tasman Drive
San Jose, California 95134-1706

ERROR: Flash datafile is corrupt.
Found magic number 0x0, but expected to find 0x1234567a.
Ignoring the rest of the file
Reading from flash...
!!.Crashinfo is NOT enabled on Full Distribution Environment
*** Output from config line 107, "crashinfo save disable"

Cryptochecksum (unchanged): 454258ae 9a77bdf6 d523f589 a3f1a682
COREDUMP UPDATE: open message queue fail: No such file or directory/2
Type help or '?' for a list of available commands.