Layer 3 Switch and ASA 5550

[swashbuckler]

I created a lab and I have a few issues. One with a layer 3 switch and another with a ASA 5550. Thanks in advanced.

1. Layer 3 switch: I have created multiple Vlans and I am able to route between them. I can ping the switch IP but not the default gateway to the ASA.

I did a tracert of the default gateway of the ASA and once I am past the Vlan gateway it fails.

Here is the config. Also, the config to the ASA is below.

2. On the ASA 5550 I created the Vlans on sub-interfaces but still cannot get to the internet. ASA config is below the switch config.

version 12.2
no service pad
service timestamps debug datetime msec
service timestamps log datetime msec
no service password-encryption
!
hostname Switch
!

no aaa new-model
ip subnet-zero
ip routing
!

spanning-tree mode pvst
spanning-tree extend system-id
!
vlan internal allocation policy ascending
!

interface GigabitEthernet0/1
switchport trunk encapsulation dot1q
switchport trunk allowed vlan 1-475
switchport mode trunk
!
interface GigabitEthernet0/2
switchport mode dynamic desirable
!
interface GigabitEthernet0/3
switchport mode dynamic desirable
!
interface GigabitEthernet0/4
switchport access vlan 465
switchport mode dynamic desirable
!
interface GigabitEthernet0/5
switchport mode dynamic desirable
!
--More--
*Mar  8 22:38:26.636: %IP-4-DUPADDR: Duplicate address 10.199.1.110 on Vlan1, sourced by 000cinterface GigabitEthernet0/6
switchport access vlan 436
switchport mode dynamic desirable
!
interface GigabitEthernet0/7
switchport mode dynamic desirable
!
interface GigabitEthernet0/8
switchport mode dynamic desirable
!
interface GigabitEthernet0/9
switchport mode dynamic desirable
!
interface GigabitEthernet0/10
switchport access vlan 400
switchport mode dynamic desirable
!
interface GigabitEthernet0/11
switchport mode dynamic desirable
!
interface GigabitEthernet0/12
switchport mode dynamic desirable
!
interface Vlan1
ip address 192.199.1.110 255.255.255.0
!
interface Vlan400
ip address 192.199.5.1 255.255.255.0
!
interface Vlan436
ip address 192.199.6.1 255.255.255.0
!
interface Vlan465
ip address 192.199.4.1 255.255.255.0
!
ip default-gateway 192.199.1.2
ip classless
ip http server
ip http secure-server
!
!
control-plane
!
!
line con 0
exec-timeout 0 0
line vty 5 15
!
end

ASA 5505 Config.

ASA Version 8.2(1)
!
hostname ASA
domain-name
enable password bsnOqWPjo7fBknMc encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
names
name 192.199.1.46 Norway
name 192.200.1.208 ENI
name 192.200.1.192 Norway_Office
name 192.199.5.0 Vlan400 description Lab
name 192.199.6.0 Vlan436 description Lab
name 192.199.4.0 Vlan465 description Lab
name 192.199.1.0 Rignet
dns-guard
!
interface GigabitEthernet0/0
nameif outside
security-level 0
ip address (Public IP and Mask)
!
interface GigabitEthernet0/1
no nameif
no security-level
no ip address
!
interface GigabitEthernet0/1.1
vlan 10
nameif insiderignet
security-level 100
ip address 192.199.1.2 255.255.255.0
!
interface GigabitEthernet0/1.400
vlan 400
nameif inside400
security-level 100
ip address 192.199.5.1 255.255.255.0
!
interface GigabitEthernet0/1.436
vlan 436
nameif inside436
security-level 100
ip address 192.199.6.1 255.255.255.0
!
interface GigabitEthernet0/1.465
vlan 465
nameif inside465
security-level 100
ip address 192.199.4.1 255.255.255.0
!
interface GigabitEthernet0/2
nameif insideNOV
security-level 100
ip address 192.10.144.47 255.255.252.0
!
interface GigabitEthernet0/3
shutdown
no nameif
security-level 100
no ip address
!
interface Management0/0
shutdown
nameif management
security-level 100
ip address 192.168.1.1 255.255.255.0
management-only
!
interface GigabitEthernet1/0
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/1
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/2
shutdown
no nameif
no security-level
no ip address
!
interface GigabitEthernet1/3
shutdown
no nameif
no security-level
no ip address
!
ftp mode passive
clock timezone MST -7
clock summer-time MDT recurring
dns server-group DefaultDNS
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object-group service WML tcp
description Remote wits data access
port-object range 1 65535
object-group network Lab
network-object Vlan465 255.255.255.0
network-object Vlan400 255.255.255.0
network-object Vlan436 255.255.255.0

access-list aclin extended permit object-group DM_INLINE_PROTOCOL_5 host 192.199.1.2 host (Public Ip)
access-list aclin extended permit object-group DM_INLINE_PROTOCOL_5 any host (Public IP)
access-list no-nat remark Local Rules
access-list no-nat extended permit ip Rignet 255.255.255.0 192.10.144.0 255.255.252.0
access-list no-nat remark Local Rules
access-list no-nat extended permit ip 192.10.144.0 255.255.252.0 Rignet 255.255.255.0

access-list no-nat extended permit ip 192.10.144.0 255.255.252.0 192.200.1.80 255.255.255.240
access-list no-nat extended permit ip Rignet 255.255.255.0 ENI 255.255.255.240
access-list no-nat extended permit ip 192.10.144.0 255.255.252.0 ENI 255.255.255.240
access-list no-nat extended permit ip Rignet 255.255.255.0 Norway_Office 255.255.255.240
access-list no-nat extended permit ip 192.10.144.0 255.255.252.0 Norway_Office 255.255.255.240
access-list no-nat remark Bobby
access-list no-nat extended permit ip 192.10.144.0 255.255.252.0 192.168.1.0 255.255.255.0
access-list no-nat extended permit ip Rignet 255.255.255.0 192.168.1.0 255.255.255.0
access-list no-nat extended permit ip object-group Lab Rignet 255.255.255.0
access-list no-nat extended permit ip Rignet 255.255.255.0 object-group Lab
access-list inside_access_in extended permit ip any any
access-list inside_access_in extended permit tcp any any
access-list inside_access_in extended permit icmp any any
access-list inside_access_in extended permit tcp interface  any
access-list inside_access_in remark Block port 135 for port scanning
access-list inside_access_in extended deny 135 any any
access-list inside_access_in extended permit object-group DM_INLINE_PROTOCOL_4 192.10.144.0 255.255.252.0 Rignet 255.255.255.0
access-list test extended permit icmp any any echo
access-list test extended permit icmp any any echo-reply
access-list InsideNOV_access_in extended permit ip 192.200.0.0 255.255.0.0 192.10.144.0 255.255.252.0
access-list InsideNOV_access_in extended permit object-group DM_INLINE_SERVICE_7 any any
access-list InsideNOV_access_in extended permit object-group DM_INLINE_SERVICE_4 Rignet 255.255.255.0 192.10.144.0 255.255.252.0
access-list InsideNOV_access_in extended permit ip Norway_Office 255.255.255.240 192.10.144.0 255.255.252.0
access-list InsideNOV_access_in extended permit ip 192.168.1.0 255.255.255.0 192.10.144.0 255.255.252.0
access-list inside_acl extended permit object-group DM_INLINE_SERVICE_8 any any
access-list inside_acl extended permit object-group DM_INLINE_SERVICE_5 192.10.144.0 255.255.252.0 Rignet 255.255.255.0
access-list inside_acl extended permit object-group DM_INLINE_SERVICE_6 Rignet 255.255.255.0 192.10.144.0 255.255.252.0
access-list inside_acl extended permit object-group DM_INLINE_PROTOCOL_192 10.200.0.0 255.255.0.0 Rignet 255.255.255.0
access-list inside_acl extended deny object-group DM_INLINE_PROTOCOL_11 host 192.168.56.1 any
access-list inside_access_in_1 extended permit object-group DM_INLINE_PROTOCOL_1 any any
access-list inside_access_in_1 extended permit object-group DM_INLINE_PROTOCOL_2 192.10.144.0 255.255.252.0 Rignet 255.255.255.0
access-list inside_access_in_1 extended permit ip Rignet 255.255.255.0 Rignet 255.255.255.0
access-list inside_access_in_1 extended permit object-group DM_INLINE_SERVICE_1 object-group Lab Rignet 255.255.255.0
access-list inside_access_in_1 extended permit object-group DM_INLINE_SERVICE_2 Rignet 255.255.255.0 object-group Lab
access-list inside_access_in_1 extended permit object-group DM_INLINE_SERVICE_9 Vlan400 255.255.255.0 Rignet 255.255.255.0
access-list BobbyLab_access_in extended permit object-group DM_INLINE_SERVICE_10 Rignet 255.255.255.0 object-group Lab
access-list inside_access_in_2 extended permit object-group DM_INLINE_SERVICE_11 Rignet 255.255.255.0 Rignet 255.255.255.0
pager lines 24
logging enable

arp timeout 14400
global (outside) 1 interface
access-group aclin in interface outside
access-group InsideNOV_access_in in interface insideNOV
route outside 0.0.0.0 0.0.0.0 (Public IP) 1

: end

[swashbuckler]

There is a unmanaged switch between.

Port on layer 3 switch is port 1

Port on ASA is port 1 (interface 0/1)

[schaef350]

You will have to add routes on the ASA to point to the L3 switch for every network behind the L3 switch. 

It looks like the networks (VLAN 10,400,436,465) that are connected to the ASA and the L3 switch.  Since they are connected at L2 already there is really no routing that has to take place... 

[swashbuckler]

a command for each Vlan: route inside (vlan IP and mask) 192.199.1.2 should work, would that also get me outside to internet

[paul driver]

Hello

Apart from requiring route back to the L3 it looks like you have duplicate addressing

--More--
*Mar 8 22:38:26.636: %IP-4-DUPADDR: Duplicate address 10.199.1.110 on Vlan1, sourced by 000cinterface GigabitEthernet0/6

Res
Paul

[swashbuckler]

when creating:   route inside 192.199.5.0 255.255.255.0 192.199.1.2

I get this in return:  ambigous command "route inside 192.199.5.0 255.255.255.0 192.199.1.2"

Anybody know why???

[swashbuckler]

i tried to add the routes from the ASA to the switch with the following command but it came back as the route already exists.

route inside 192.199.5.0 255.255.255.0 192.199.1.110 1

I also tried

route inside 192.199.1.2 255.255.255.0 192.199.1.110

and recieved same thing, route exists

[schaef350 · Accepted solution]

Right, the route already exists because the ASA has an interface addressed in the 192.199.5.0 and 192.199.1.0 subnets.  You have what looks to be a handful of subnets that exist on the ASA as well as the L3 switch.  All are not necessary.  Currently the ASA will do the routing.  If you wanted to add subnets exclusive to the L3 switch is when you will need to start adding routes to your ASA. 

pdriver is right in saying your addresses are duplicated on the ASA and the L3 switch (from what I can tell from the configs)