Routing from Switch VLAN to ASA

[ashy516]

I have an ASA 5515x connected to a Layer 3 (3750x) switch with multiple interfaces (Inside, DMZ, Cellular, Guest) and a connection to a 3750 where I have VLANs, and IP Routing enabled.

Not to be able to reach the internet from any of these VLANs and workstations. I'm able to ping back and forth from ASA to Switch and vice-versa (Interfaces). I'm unable to ping the ASA interface from Workstation (192.168.5.10). I'm convinced there's a route missing from the switch or access-list from the ASA.

ASA Routes

S*       0.0.0.0 0.0.0.0 [1/0] via 172.16.0.1, outside

S        10.50.0.0 255.255.0.0 [1/0] via 10.100.1.2, inside

C        10.60.1.0 255.255.255.252 is directly connected, Guest-Network

L        10.60.1.1 255.255.255.255 is directly connected, Guest-Network

C        10.60.1.4 255.255.255.252 is directly connected, DMZ

L        10.60.1.5 255.255.255.255 is directly connected, DMZ

C        10.100.1.0 255.255.255.248 is directly connected, inside

L        10.100.1.1 255.255.255.255 is directly connected, inside

C        172.16.0.0 255.255.255.0 is directly connected, outside

L        172.16.0.156 255.255.255.255 is directly connected, outside

S        192.168.5.0 255.255.255.240 [1/0] via 10.60.1.6, DMZ

S        192.168.15.0 255.255.255.255 [1/0] via 10.60.1.2, Guest-Network

Switch Routes

ip route 10.50.0.0 255.255.0.0 10.100.1.1

ip route 192.168.2.0 255.255.255.240 10.60.1.9

ip route 192.168.5.0 255.255.255.240 10.60.1.5

ip route 192.168.15.0 255.255.255.240 10.60.1.1

I've included the network diagram and configs for both devices.

Thank you in advance.

[Francesco Molino]

Hi

Which ASA interface are you trying to reach from your host?

Also, why are you having the following route on your switch? This subnet is on your switch, so why do you have a static route with ASA as your next hop?

ip route 192.168.5.0 255.255.255.240 10.60.1.5

[ashy516]

Thank you @Francesco Molino 

"Which ASA interface are you trying to reach from your host?" 
I'm trying to reach the Internet from the hosts (any wkstn on any vlan). I'm able to host the VLAN interface, SVI, and ASA interface. But I'm about to ping 8.8.8.8 and get out to the internet

"Also, why are you having the following route on your switch? This subnet is on your switch, so why do you have a static route with ASA as your next hop? ip route 192.168.5.0 255.255.255.240 10.60.1.5"

Yes, this 192.168.5.0 subnet is a VLAN. I've added this route so it can get out to ASA. Please let me know if that's incorrect and what should it look like. 

Thank you. 

[Francesco Molino]

The static route I talked about is on your switch and not necessary.

To reach out the internet, you’re missing the default route: ip route 0.0.0.0 0.0.0.0 10.60.1.5

Then you’re missing a nat like:

object network DMZ-HOSTS

  subnet 192.168.5.0 255.255.255.240

  nat (DMZ, outside) dynamic interface

However, all your interfaces on your switch and not routed through the same ASA interface (return traffic from ASA to 192.168.5.0 or 192.168.15.0 isn’t taking the same path). In that situation, you have several options:

- use VRFs to separate all VLANs that must be in the same zone, so you can have a default route in each vrf

- use PBR to route based on source network and not only destination

- simplify your network to only have 1 interconnect subnet between switch and asa for all vlans.

[ashy516]

Thank you, @Francesco Molino “

“To reach out the internet, you’re missing the default route: ip route 0.0.0.0 0.0.0.0 10.60.1.5” I had it set up that way where all vlans were routed thru the same default route. The issue there is I had no VLAN separation which is what I was hoping to gain from using the ASA to have multiple networks ( DMZ, inside, Guest, etc) 

As you suggested the best option would be to use  VRFs. However I have no experience with such configuration. May you suggest how I config one or two networks and I will do the others? I know that’s asking a lot. Thank you in advance. 

[Francesco Molino]

I will prepare you a config over the weekend to give you an example of your config migrated to a VRF aware config. 

Obviously this means you have the right IOS running on your 3750.

Can you do a show version please and share the output?

[ashy516]

@Francesco Molino Thank you. 

Here's the requested info. 

CiscoHomeSwitch#sh version
Cisco IOS Software, C3750E Software (C3750E-UNIVERSALK9NPE-M), Version 15.2(2)E5 , RELEASE SOFTWARE (fc2)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2016 by Cisco Systems, Inc.
Compiled Thu 02-Jun-16 00:50 by prod_rel_team

ROM: Bootstrap program is C3750E boot loader
BOOTLDR: C3750E Boot Loader (C3750X-HBOOT-M) Version 15.2(3r)E, RELEASE SOFTWARE (fc1)

CiscoHomeSwitch uptime is 3 minutes
System returned to ROM by power-on
System image file is "flash:/c3750e-universalk9npe-mz.152-2.E5/c3750e-universalk 9npe-mz.152-2.E5.bin"
Last reload reason: power-on

License Level: ipbase
License Type: Permanent
Next reload license Level: ipbase

cisco WS-C3750X-48P (PowerPC405) processor (revision W0) with 262144K bytes of m emory.
Processor board ID 
Last reset from power-on
8 Virtual Ethernet interfaces
1 FastEthernet interface
52 Gigabit Ethernet interfaces
2 Ten Gigabit Ethernet interfaces
The password-recovery mechanism is enabled.

512K bytes of flash-simulated non-volatile configuration memory.
Base ethernet MAC Address : 28:6F:7F:27:86:80
Motherboard assembly number : 73-15477-04
Motherboard serial number : FDO20432CUZ
Model revision number : W0
Motherboard revision number : B0
Model number : WS-C3750X-48P-S
Daughterboard assembly number : 800-32727-03
Daughterboard serial number : 
System serial number : 
Top Assembly Part Number : 800-38991-01
Top Assembly Revision Number : F0
Version ID : V07
CLEI Code Number : CMMPS00DRB
Hardware Board Revision Number : 0x05

Switch Ports Model SW Version SW Image
------ ----- ----- ---------- ----------
* 1 54 WS-C3750X-48P 15.2(2)E5 C3750E-UNIVERSALK9N PE-M

Configuration register is 0xF

CiscoHomeSwitch#

[Francesco Molino]

Below an example of your configuration with vrf:

ip vrf DMZ
ip vrf Guest-Network
ip vrf inside
!
interface Vlan5
 ip vrf forwarding DMZ
 ip address 192.168.5.1 255.255.255.240
!
interface Vlan10
 ip vrf forwarding inside
 ip address 10.50.0.1 255.255.0.0
!
interface GigabitEthernet1/0/13
 no switchport
 ip vrf forwarding inside
 ip address 10.100.1.2 255.255.255.248
!
interface GigabitEthernet1/0/37
 no switchport
 ip vrf forwarding Guest-Network
 ip address 10.60.1.2 255.255.255.252
!
interface GigabitEthernet1/0/4
 no switchport
 ip vrf forwarding DMZ
 ip address 10.60.1.6 255.255.255.252
!
interface Vlan15
 description Guest VLAN Network
 ip vrf forwarding Guest-Network
 ip address 192.168.15.1 255.255.255.240
 ip helper-address 192.168.15.1
!
ip route vrf DMZ 0.0.0.0 0.0.0.0 10.60.1.5
ip route vrf Guest-Network 0.0.0.0 0.0.0.0 10.60.1.1
ip route vrf inside 0.0.0.0 0.0.0.0 10.100.1.1

However, you will need to have ipservices license.