04-26-2017 11:01 AM - edited 03-08-2019 10:21 AM
Using PT 7.0 on a windows 10 PC
I have built a small network of 6 end nodes all on different subnets on a 3560 switches, out of the box I would not think they should be able to talk to each other, due to no ACL allowing them too.
Yet they can,
Next
I have an asa5505 hanging off the 3560 and a 2911 router off that, and another 2911 off that with a server off the last router.
the switch can ping the inside firewall, but not through it, fine, no ACL allowing it.
All the end nodes can ping the 3560 interface going to the FW but not the Inside FW interface.
I have a static route 0.0.0.0 0.0.0.0 192.168.1.2
04-26-2017 11:14 AM
First question, you do not need acls to allow traffic, it is the opposite ie. acls filter traffic.
Second question, you need to add routes to firewall eg. -
"route inside 192.168.97.0 255.255.255.0 192.168.1.2"
you need a route for each internal subnet using the same next hop IP.
Jon
04-26-2017 11:36 AM
okay, i added the followign
route inside 192.168.96.0 255.255.255.0 64.5.141.1
that would be the next hop outbound, I am still unable to ping R0
coming from the outside i have server2 so it can ping R1 and R0, well the outside interface anyway of R0
I have BGP setup between R1 and R0
Router#sho ip bgp nei
BGP neighbor is 216.54.0.109, remote AS 11222, external link
BGP version 4, remote router ID 216.54.0.109
BGP state = Established, up for 00:05:15
Last read 00:05:15, last write 00:05:15, hold time is 180, keepalive interval is 60 seconds
Neighbor capabilities:
Route refresh: advertised and received(new)
Address family IPv4 Unicast: advertised and received
Message statistics:
InQ depth is 0
OutQ depth is 0
Sent Rcvd
Opens: 1 1
Notifications: 0 0
Updates: 0 0
Keepalives: 6 6
Route Refresh: 0 0
Total: 7 7
Default minimum time between advertisements runs is 30 seconds
For address family: IPv4 Unicast
BGP table version 1, neighbor version 6/0
Output queue size : 0
Index 1, Offset 0, Mask 0x2
1 update-group member
Sent Rcvd
Prefix activity: ---- ----
Prefixes Current: 0 0 (Consumes 0 bytes)
Prefixes total: 0 0
Implicit Withdraw: 0 0
Explicit Withdraw: 0 0
Used as bestpath: n/a 1
Used as multipath: n/a 0
Outbound Inbound
Local Policy Denied Prefixes: -------- -------
Total: 0 0
Number of NLRIs in the update sent: max 3, min 1
Address tracking is enabled, the RIB does have a route to 216.54.0.109
Connections established 1; dropped 1
Last reset never
Transport(tcp) path-mtu-discovery is enabled
Connection state is ESTAB, I/O status: 1, unread input bytes: 0
Connection is ECN Disabled, Minimum incoming TTL 0, Outgoing TTL 1
Local host: 216.54.0.110, Local port: 179
Foreign host: 216.54.0.109, Foreign port: 1025
Connection tableid (VRF): 0
Enqueued packets for retransmit: 0, input: 0 mis-ordered: 0 (0 bytes)
Event Timers (current time is 0xC69F4):
Timer Starts Wakeups Next
Retrans 0 0 0x0
TimeWait 0 0 0x0
AckHold 6 0 0x0
SendWnd 0 0 0x0
KeepAlive 6 0 0x0
GiveUp 0 0 0x0
PmtuAger 0 0 0x0
DeadWait 0 0 0x0
Linger 0 0 0x0
ProcessQ 0 0 0x0
iss: 2057115318 snduna: 2057115748 sndnxt: 2057115748 sndwnd: 15955
irs: 3480424370 rcvnxt: 3480424751 rcvwnd: 16004 delrcvwnd: 380
SRTT: 259 ms, RTTO: 579 ms, RTV: 320 ms, KRTT: 0 ms
minRTT: 16 ms, maxRTT: 300 ms, ACK hold: 200 ms
Status Flags: passive open, gen tcbs
Option Flags: nagle, path mtu capable
IP Precedence value : 6
Datagrams (max data segment is 1460 bytes):
Rcvd: 7 (out of order: 0), with data: 0, total data bytes: 0
Sent: 7 (retransmit: 0, fastretransmit: 0, partialack: 0, Second Congestion: 0), with data: 0, total data bytes: 0
Packets received in fast path: 0, fast processed: 0, slow path: 0
fast lock acquisition failures: 0, slow path: 0
R0 can ping the outside server Server 2
just cant get from my inside to pass traffic to the outside through the switch, it stops at the switch
04-26-2017 12:08 PM
I gave you the next hop IP based on your switch configuration so why have you used a completely different one ?
Your firewall needs to know how to reach the subnets on your 3560 so the next hop IP has to be on the 3560.
Jon
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: