cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
357
Views
0
Helpful
1
Replies

Dear friends i could not ping one lan to other asa lan but from inside lan i can ping to next hop address from any of asa but i am unable to ping from the lan of one ASA-1 TO lan of ASA-2 please can any one help in this regard.

Dear friends i could not ping one lan to other asa lan but from inside lan i can ping to next hop address from any of asa but i am unable to ping from the lan of one ASA-1 TO lan of ASA-2 please can any one help in this regard.

ASA-1

ASA Version 8.4(2)

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface GigabitEthernet0

nameif outside

security-level 0

ip address 209.165.200.202 255.255.255.0

!

interface GigabitEthernet1

nameif inside

security-level 100

ip address 30.0.1.1 255.255.255.0

!

interface GigabitEthernet2

nameif dmz

security-level 30

ip address 172.16.10.1 255.255.255.0

!

interface GigabitEthernet3

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet4

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet5

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

object network INSIDE_LAN

subnet 30.0.1.0 255.255.255.0

description INSIDE-LAN

access-list OUTSIDE-ACCESS extended permit ip any any

access-list OUTSIDE-ACCESS extended permit icmp any any echo-reply

access-list OUTSIDE-ACCESS extended permit icmp any any echo

access-list OUTSIDE-ACCESS extended permit tcp any any eq www

access-list OUTSIDE-ACCESS extended permit tcp any any eq https

access-list OUTSIDE-ACCESS extended permit tcp any any eq gopher

access-list INSIDE-ACCESS extended permit ip any any

pager lines 24

mtu outside 1500

mtu inside 1500

mtu dmz 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network INSIDE_LAN

nat (inside,outside) dynamic interface

access-group OUTSIDE-ACCESS in interface outside

access-group INSIDE-ACCESS in interface inside

route outside 0.0.0.0 0.0.0.0 209.165.200.201 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect icmp

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 1

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

crashinfo save disable

Cryptochecksum:a37a84ea3c28f1a89e0ab88a907325ea

: end

ciscoasa(config)#

ASA -2

ciscoasa(config)# SHO RUN

: Saved

:

ASA Version 8.4(2)

!

hostname ciscoasa

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface GigabitEthernet0

nameif outside

security-level 0

ip address 209.165.200.201 255.255.255.0

!

interface GigabitEthernet1

nameif inside

security-level 100

ip address 10.0.1.1 255.255.255.0

!

interface GigabitEthernet2

nameif dmz

security-level 30

ip address 172.16.1.1 255.255.255.0

!

interface GigabitEthernet3

shutdown

no nameif

no security-level

no ip address

!

interface GigabitEthernet4

shutdown

no nameif

no security-level

no ip address

!

ftp mode passive

object network INSIDE_LOCAL

subnet 10.0.1.0 255.255.255.0

description INSIDE-LAN

access-list OUTSIDE-ACCESS extended permit ip any any

access-list OUTSIDE-ACCESS extended permit icmp any any echo-reply

access-list OUTSIDE-ACCESS extended permit icmp any any echo

access-list OUTSIDE-ACCESS extended permit tcp any any eq www

access-list OUTSIDE-ACCESS extended permit tcp any any eq gopher

access-list OUTSIDE-ACCESS extended permit tcp any any eq https

access-list INSIDE-ACCESS extended permit ip any any

pager lines 24

mtu outside 1500

mtu inside 1500

mtu dmz 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

!

object network INSIDE_LOCAL

nat (inside,outside) dynamic interface

access-group OUTSIDE-ACCESS in interface outside

access-group INSIDE-ACCESS in interface inside

route outside 0.0.0.0 0.0.0.0 209.165.200.202 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

console timeout 0

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect icmp

  inspect skinny

  inspect sunrpc

  inspect xdmcp

  inspect sip

  inspect netbios

  inspect tftp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous prompt 1

call-home

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

crashinfo save disable

Cryptochecksum:9237c6aac195411cc8198673856511fb

: end

1 Reply 1

james.doukas
Beginner
Beginner

I think you need inside routes as well as outside routes. I don't think the inside networks know about the networks on the other ASA. I've only worked on old PIX firewalls so things might be different now.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers