Roger
so remember the plan was to remove the 2921 interface and use 10.10.10.2 on the inter with 10.20.60.2...
But you haven't done this according to the configs you have just posted.
The idea is to use the inside interface to connect to the 2921 so that you do not need to change any NAT statements on the ASA. But you still have the 2921 interface connected to the router. So do this (note you will need downtime) -
1) shutdown the 2921 interface on the ASA and remove the address from the config.
2) remove the cable from the inside interface of the ASA that i think still connects to a switch.
3) take the cable that is in the 2921 interface on the ASA and connect it to the inside interface of the ASA.
Now the 2921 router physical connection runs from gi0/2 on the router to the inside interface of the ASA.
4) remove the 10.20.60.2 address from the inside interface on the ASA and add the 10.10.10.2 address that was previously on the 2921 ASA interface.
5) these routes on the ASA need changing -
a) remove these -
no route 2921 10.20.30.0 255.255.254.0 10.10.10.1 1
no route 2921 192.168.2.0 255.255.255.0 10.10.10.1 1
b) add these
route inside 10.20.30.0 255.255.254.0 10.10.10.1 1
route inside 192.168.2.0 255.255.255.0 10.10.10.1 1
6) add this route to the 2921
ip route 0.0.0.0 0.0.0.0 10.10.10.2
That should do it. As i say you will need downtime but once done all internal vlans should route via the 2921 and the ASA should only be used for internet. The ASA NAT statements reference the inside interface so it should just work.
Jon
