Routing between Vlans

[WezMorris40]

We run a small company network where everything runs on the native VLan but recently a second internet line and server was installed on a second VLan.

Attached is a pic of the network setup and our current config.

Currently the orange Vlan (VLan 30) has zero communication with the rest of the network. What steps would I need to take so that we could remote desktop to that server?

I can't see a way of getting the Inside and BT_DMZ interfaces to talk to each other.

Our end game is to eventually get the DMZ using the BT managed router and ditch the PIX entirely.

I'm fairly rookie when it comes to networking, most of what I've done is through the ASDM gui and even then most was guesswork.

Any help you could provide is much appreciated

[WezMorris40]

Not sure I follow, do I need to make a new sub interface on top of BT_Outside, and assign it to VLAN30 ?

Basically, My vlan 30 server can ping the firewall interface on 10.20.3.2 but can't access the internet. Can't work out why.

Could I need to set up a staic route between The BT_dmz and the BT_Outside interfaces?

[martin_knorre]

No, no subinterface, the normal one should be perfect, like the other outside interface.

Regards Martin

[WezMorris40]

Ok, that makes sense.

However I still can't access the BT_Dmz from outside the firewall

Any chance you could look at the attached config and see if I've missed something?

[WezMorris40]

Quick update, the interface can't actually ping the server on the vlan and vice versa.

I'm thinking this may be a problem with connectivity between that interface and the vlan itself. Can I just reuse the command that jenifer suggested:

"static (bt_outside,bt-dmz) ??? 10.20.3.0 netmask 255.255.255.0" or something to that effect?

[Jennifer Halim]

Sorry, didn't follow the last few posts, but to just summarise the design so far:

- You have moved the BT_Outside interface from the PIX to the ASA, and now you have 2 Outside interfaces on the ASA.

- 1 question, are you actually going to be using both Outside interfaces at the same time for load balancing? or you have specific things that you would like to route via 1 Outside interface and something else via the other Outside interface.

The reason why I ask is on an ASA, you can not have 2 default gateways configured (not supported on the ASA). Since you have 2 Outside interfaces now, I am not sure if you are planning to use both at the same time. If not, then it's good.

OK, now coming back to your original question:

- You would like connectivity between BT_OUTSIDE and BT-DMZ. Are you actually connecting directly from BT_OUTSIDE subnet? or somewhere else? Are you going to access BT-DMZ subnet with its private IP address, or you would like to perform NAT? if you are going to access BT-DMZ private IP, then here is the static NAT statement:

static (bt_dmz,BT_Outside) 10.20.3.0 10.20.3.0 netmask 255.255.255.0

Ping should work for now as you have permit ping via ACL: BT_Outside_access_in. If you need further access, you have to allow that explicityly on ACL: BT_Outside_access_in.

[martin_knorre]

Hi,

no I think he doesn't want to perform a NAT, he want to route the traffic originated from BT DMZ vlan to the BT Line.

If so you should set up a Route Map for a defined subnet: see http://www.cisco.com/en/US/docs/security/asa/asa82/configuration/guide/route_maps.html

rgds Martin

[Jennifer Halim]

That's exactly how you configure it when you don't want to NAT, ie: configure static NAT to itself which is a requirement on an ASA when traffic is initiated from low to high security level.

Secondly, route-map on ASA does not work the same way as route-map on router. Route-map on ASA is only used for redistribution, and it can't be used for PBR.

[WezMorris40]

I don't want load balancing or anything, we just want servers to use a different internet connection to our PCs and phones.

halijenn wrote:
You would like connectivity between BT_OUTSIDE and BT-DMZ. Are you actually connecting directly from BT_OUTSIDE subnet? or somewhere else? Are you going to access BT-DMZ subnet with its private IP address, or you would like to perform NAT? if you are going to access BT-DMZ private IP, then here is the static NAT statement:
static (bt_dmz,BT_Outside) 10.20.3.0 10.20.3.0 netmask 255.255.255.0
Ping should work for now as you have permit ping via ACL: BT_Outside_access_in. If you need further access, you have to allow that explicityly on ACL: BT_Outside_access_in.

Sorry, not sure I follow. Basically I have a bunch of external IPs provided to me by the ISP and I want them to map directly to the internal IP ie xxx.xxx.82.151 -> 10.20.3.151.

VLAN 30 currently uses a PIX firewall for this role and I just want to phase out the PIX and just use the ASA for both purposes if possible.

[Jennifer Halim]

Not supported.

If you have 2 internet connections, that means you will need to have 2 default gateways. ASA can't have 2 default gateways connected to 2 interfaces.

[WezMorris40]

Really? So we can't even section off one connection as part of a seperate VLAN?

Does that mean I'm stuck using a different physical router for each line? When I set up the second interface, I had set the administrative distance to 2 (the first 0.0.0.0 interface was 1). I had figured as long as traffic was forced from the BT_dmz to that, Ad Dist wouldn't matter.

I would have thought that the BT_dmz,BT_Outside nat rule you gave me would allow traffic to travel between those interfaces. If not, what does that actually do?

[Jennifer Halim]

Since you require default gateways to both your outside interfaces as they are connected to 2 separate interfaces, and there are requirements to access both interfaces from the Internet, the answer unfortunately is NO, purely because of the requirements of 2 default gateways.

The problem is the ASA would not know which default gateway to send the traffic to, ie: whether it should be sent to the ISP 1 or ISP 2.

The NAT rule that I gave you provide a translation statement which are needed for traffic to flow from BT_Outside to BT_dmz and vice versa. Do you actually require access from the internet towards BT_dmz hosts? if you do, then you actually need to translate the private IP to public IP. If not, are you actually trying to access the BT_dmz hosts just from hosts directly connected to the BT_Outside interface?

[WezMorris40]

I only need access to and from those servers in terms of serving out websites.

I think we may have confused the issue a little bit, or at least I have. When you say the ASA can't have 2 default gateways, do you mean 2 gateways serving the same traffic? i.e. My local PC using both lines to surf out.

Can I not have 2 outside interfaces, have 1 as the default gateway for the inside network, and 1 for the VLAN30 Network? Or can the ASA not support 2 external lines full stop?

[Jennifer Halim]

ASA does not support 2 external lines when you have to configure 2 default gateways. It doesn't matter even if you divide server access from the internet to use 1 internet connection and everything else to use the other internet connection because 2 default gateways can't exist at the same time.

Unless you know the route exactly through one of the ISP, then instead of configuring default gateway for 1 ISP, you configure static route to point towards the ISP. However, if you are just routing out to the Internet, then you will not know the exact IP address/subnet on the Internet that you need ot use for 1 ISP, hence from routing point of view, you need to configure default gateway. However, 2 default gateways are not supported on an ASA, you will need a router and configure Policy Based Routing on the router to route the traffic accordingly. ASA being a security device does not have the full functionality of a router unfortunately.

[martin_knorre]

Hi,

the quick and dirty method now would be, that you belong by your standard and desing.

But your problem is overall actually not a VLAN problem because the ASA has defenitly an access rule who blocks the traffic. And VLANs can only communicate with others over a Layer 3 Instance like a router or firewall.

Another option would be that you redesign your network a bit.

Depending on how many workers are with you ;-)

you can create on one interface of the ASA, subinterfaces for every VLAN with an IP add.

like this example:

Eth0/3.300 BT dmz

Eth0/3.40 DMZ
Eth0/3.10 clients
Eth0/3.20 server
Eth0/3.30 Voice

Connect this link with a trunk port of one switch with allowed VLANs for your purposes.

In that case you have only one inside interface into the campus at all and no native VLAN issues in future.

greetings

Martin         

[WezMorris40]

I think you're right about a slight redesign, though I've gotta keep the DMZ servers running so I can't pull everything out and try again.

I've attached a pic of what I think the new layout shout be, and I think it should be fairly easy to impliment. I dont think I would have to change any settings, now that I can RDP onto the VLAN servers. It's a guess anyway, feel free to tell me if I've got it all wrong

Would it possible to have only VLAN 30 serve out on the BT line with this new setup?

And If I wanted to move servers onto VLAN 30, would it just be a case of changing the subnet & changing which vlan the port connects to?