Thank you Karsten. Very helpful indeed.   Kind Regards, Dena ... View more

Thank you for your help Karsten,   I am not sure if I understood well. If I choose one of four solutions proposed by you, then I have to build a DNS server. Right? Or should I use ISP /open DNS? ... View more

Hi,  Balaji, no need to investigate further. Thank you for your help. Ping was being blocked by the windows Defender firewall.   Kind Regards, Denisa ... View more

Hi Balaji, in the ASDM syslog messages I cannot see any blocking. I have connected two laptops (one on vlan10 and one on vlan20). I am able to ssh and telnet the switch. But I am not able to ping from one laptop to another. I removed both the laptops from Bitdiffender. The ASA configuration as below: ASA Version 9.8(2) ! hostname ciscoasa enable password xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx xlate per-session deny tcp any4 any4 xlate per-session deny tcp any4 any6 xlate per-session deny tcp any6 any4 xlate per-session deny tcp any6 any6 xlate per-session deny udp any4 any4 eq domain xlate per-session deny udp any4 any6 eq domain xlate per-session deny udp any6 any4 eq domain xlate per-session deny udp any6 any6 eq domain names ! interface GigabitEthernet1/1 description LAN no nameif no security-level no ip address ! interface GigabitEthernet1/1.10 vlan 10 nameif Projektet security-level 100 ip address 192.168.10.1 255.255.255.0 ! interface GigabitEthernet1/1.12 vlan 12 nameif MGT security-level 100 ip address 192.168.12.1 255.255.255.0 ! interface GigabitEthernet1/1.13 vlan 13 nameif Services security-level 100 ip address 192.168.13.1 255.255.255.0 ! interface GigabitEthernet1/1.20 vlan 20 nameif Dyqani security-level 100 ip address 192.168.20.1 255.255.255.0 ! interface GigabitEthernet1/1.30 vlan 30 nameif Servisi security-level 100 ip address 192.168.30.1 255.255.255.0 ! interface GigabitEthernet1/2 no nameif no security-level no ip address ! interface GigabitEthernet1/3 no nameif no security-level no ip address ! interface GigabitEthernet1/4 no nameif no security-level no ip address ! interface GigabitEthernet1/5 no nameif no security-level no ip address ! interface GigabitEthernet1/6 shutdown no nameif no security-level no ip address ! interface GigabitEthernet1/7 nameif LAN-B security-level 100 ip address 192.168.5.1 255.255.255.0 ! interface GigabitEthernet1/8 nameif ConnToMikrotik security-level 0 ip address 172.30.30.2 255.255.255.0 ! interface Management1/1 management-only nameif management security-level 0 ip address 192.168.0.1 255.255.255.0 ! ftp mode passive clock timezone CEST 1 clock summer-time CEDT recurring last Sun Mar 2:00 last Sun Oct 3:00 dns domain-lookup ConnToMikrotik forward-reference enable same-security-traffic permit inter-interface same-security-traffic permit intra-interface object network 172.30.30.1 host 172.30.30.1 object network 192.168.10.1 host 192.168.10.1 object-group protocol TCPUDP protocol-object udp protocol-object tcp pager lines 24 logging enable logging asdm informational mtu Services 1500 mtu Projektet 1500 mtu Dyqani 1500 mtu Servisi 1500 mtu MGT 1500 mtu management 1500 mtu ConnToMikrotik 1500 mtu LAN-B 1500 icmp unreachable rate-limit 1 burst-size 1 icmp permit any Services icmp permit any Projektet icmp permit any Dyqani icmp permit any Servisi icmp permit any MGT no asdm history enable arp timeout 14400 no arp permit-nonconnected arp rate-limit 16384 nat (Dyqani,ConnToMikrotik) source static any interface nat (Servisi,ConnToMikrotik) source static any interface nat (Services,ConnToMikrotik) source static any interface nat (Projektet,ConnToMikrotik) source static any interface nat (MGT,ConnToMikrotik) source static any interface route ConnToMikrotik 0.0.0.0 0.0.0.0 172.30.30.1 1 timeout xlate 3:00:00 timeout pat-xlate 0:00:30 timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 sctp 0:02:00 icmp 0:00:02 timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00 timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00 timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute timeout tcp-proxy-reassembly 0:01:00 timeout floating-conn 0:00:00 timeout conn-holddown 0:00:15 timeout igp stale-route 0:01:10 user-identity default-domain LOCAL aaa authentication ssh console LOCAL aaa authentication http console LOCAL aaa authentication login-history http server enable http 192.168.0.0 255.255.255.0 management http 192.168.5.0 255.255.255.0 LAN-B http 192.168.12.0 255.255.255.0 MGT http 192.168.10.0 255.255.255.0 Projektet no snmp-server location no snmp-server contact service sw-reset-button crypto ipsec security-association pmtu-aging infinite crypto ca trustpool policy telnet timeout 5 ssh 192.168.10.0 255.255.255.0 Projektet ssh 192.168.12.0 255.255.255.0 MGT ssh 192.168.5.0 255.255.255.0 LAN-B ssh timeout 5 ssh version 2 ssh key-exchange group dh-group1-sha1 console timeout 0 dhcpd address 192.168.10.10-192.168.10.200 Projektet dhcpd dns 8.8.8.8 8.8.4.4 interface Projektet dhcpd enable Projektet ! dhcpd address 192.168.20.10-192.168.20.200 Dyqani dhcpd dns 8.8.8.8 8.8.4.4 interface Dyqani dhcpd enable Dyqani ! dhcpd address 192.168.12.10-192.168.12.200 MGT dhcpd dns 8.8.8.8 8.8.4.4 interface MGT dhcpd enable MGT ! dhcpd address 192.168.5.130-192.168.5.200 LAN-B dhcpd dns 8.8.8.8 8.8.4.4 interface LAN-B dhcpd domain pcstore.al interface LAN-B dhcpd enable LAN-B ! threat-detection basic-threat threat-detection statistics access-list no threat-detection statistics tcp-intercept dynamic-access-policy-record DfltAccessPolicy username yyyyyyyyyyyy password xxxxxxxxxxxxxxxxxxxxxx ! class-map inspection_default match default-inspection-traffic ! ! policy-map type inspect dns preset_dns_map parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map global_policy class inspection_default inspect ftp inspect h323 h225 inspect h323 ras inspect ip-options inspect netbios inspect rsh inspect rtsp inspect skinny inspect esmtp inspect sqlnet inspect sunrpc inspect tftp inspect sip inspect xdmcp inspect dns preset_dns_map inspect icmp policy-map type inspect dns migrated_dns_map_2 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection policy-map type inspect dns migrated_dns_map_1 parameters message-length maximum client auto message-length maximum 512 no tcp-inspection ! service-policy global_policy global prompt hostname context no call-home reporting anonymous call-home profile CiscoTAC-1 no active destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService destination address email callhome@cisco.com destination transport-method http subscribe-to-alert-group diagnostic subscribe-to-alert-group environment subscribe-to-alert-group inventory periodic monthly subscribe-to-alert-group configuration periodic monthly subscribe-to-alert-group telemetry periodic daily Cryptochecksum:xxxxxxxxxxxxxxx : end Thank you, Denisa ... View more

Hello Balaji, Yes, you are right. The problem is that I have configured: same-security-traffic permit inter-interface same-security-traffic permit intra-interface and it is not allowed inter-vlan communication. Also: policy-map global_policy class inspection_default ... inspect icmp I am going to add also "icmp permit any". to see what changes. Any other idea?   Thank you, Denisa     ... View more

hi, thank you for your reply.   #show inter trunk Port Mode Encapsulation Status Native vlan Gi1/0/24 on 802.1q trunking 12 Port Vlans allowed on trunk Gi1/0/24 1-4094 Port Vlans allowed and active in management domain Gi1/0/24 1,10,12-13,20,30 Port Vlans in spanning tree forwarding state and not pruned Gi1/0/24 1,10,12-13,20,30   I want the PC to be on a vlan that is different from the MGT-vlan (12vlan in this case-192.168.12.0/24). So I have the PC 192.168.10.11 (vlan10) and I cannot ping vlan12 (sub-int:192.168.12.1), neither the inter-vlan on switch (192.168.12.12). I am able to open ping the router also ssh,http it. But can't ping the subinterfaces on the ASA. not able to ping from one vlan to another. for example from vlan 13 to vlan 10. thank you, Denisa     ... View more

Hi all, sorry my late reply. I have been on holiday.   ASA was denying some pages because of an access rule (open port 7070) that I created for testing purposes. With this access rule I just open the port 7070 (realserver) on ASA for my laptop. And I don't know Why access-group outside_Abissnet_access_in in interface outside_Abissnet resulted in denying some pages.    Thank you, Kind Regards, Denisa ... View more

hi Balaji, yes I have configured ASDM access. I can see logs like the one below, when I try to open pages that are being blocked by ASA: 4 Jul 07 2019 15:36:27 113.255.38.74 12113 192.168.2.131 18231 Deny udp src outside_Abissnet:113.255.38.74/12113 dst LAN_PCstore:192.168.2.131/18231 by access-group "outside_Abissnet_access_in" [0x0, 0x0] I dont understand why! When I first connected today I was able to open every page. Suddenly now the access for some pages is disappeared! As I understand, ASA is state-full FW, it must allow the reply back of the requests that are initiated from inside. ciscoasa# show run access-list access-list outside_Abcom_access_in extended permit tcp any object VOIP-192.168.3.33 eq sip access-list outside_Abcom_access_in extended permit object-group DM_INLINE_SERVICE_1 any object test-192.168.2.131 access-list outside_Abissnet_access_in extended permit tcp any object VOIP-192.168.3.33 eq sip access-list outside_Abissnet_access_in extended permit object test-7070 any object test-192.168.2.131 ciscoasa# show run access-group access-group outside_Abissnet_access_in in interface outside_Abissnet access-group outside_Abcom_access_in in interface outside_Abcom   I have attached some other Deny logs also   Thank you, Denisa ... View more

Yes, it make sense. I configured the dns of google under dhcpd. Unfortunately, I am having a strange situation with both provider. Some of pages like cisco.com or community.cisco.com (everything on the cisco domains) cannot be open. I am able to nslookup these domains. But not able to open on browser. Or when I try to test internet speed - it displays error "may be blocked by a firewall".   Should I create an access list permit rule? Any idea would be appreciated.    Kind Regards, Denisa ... View more

yes Balaji correct, it is working with both the ISPs.   But I am not sure how to configure the dns for dhcp for both ISPs. I configured the dns on one ISP as below: dhcpd address 192.168.2.130-192.168.2.200 LAN_PC dhcpd dns 80.x.x.x 80.x.x.x interface LAN_PC dhcpd domain pc.al interface LAN_PC dhcpd enable LAN_PC but it is not working for the other ISP unless I add the static dns on the network card of the PCs.   What do you think, should I configure public dns under dhcp?   Or should I add global dns as below: dns server-group DefaultDNS name-server 208.67.222.222    ******public ISP****** name-server 80.x.y.35     ******first ISP dns****** name-server 80.x.y.34 name-server 80.x.y.66    ******seond ISP dns****** name-server 80.x.y.67 name-server 192.167.2.7   Attached the view of ASDM for dns.   Thank you in advanced, Denisa ... View more

Hi,    Update: The problem was on the ISP side.   Kind Regards, Denisa ... View more

hi, yes correct. I created PPPoe connection straight to ASA.   Kind Regards, Denisa ... View more