Another question :(
On an ASA 5520 I am trying to configure sub interfaces. However was created I am unable to ping that sub interfaces address from anywhere outside of its subnet. The setup is as follows:
GIG0/0 Inside, 10.177.8.41, 255.255.255.248, Native, Security level 100
GIG0/0.27 Test, 10.177.27.240, 255.255.255.0, Vlan 27, Security level 100
GIG0/1 Outside, 220.127.116.11, 255.255.255.248, Native, Security level 0
Configured routes are:
10.177.0.0, 255.255.128.0 > 10.177.8.46
If I ping from a device within the 10.177.27.x subnet I can reach the Test subinterface. If I ping from outside of that subnet (ie from my machine of 10.177.29.251) I get no response. The logs on the ASA show the following:
110003 Routing failed to locate next hop for icmp from Test:10.177.27.240/0 to Test:10.177.29.251/0
On my switch which connects the ASA to the network I have the uplink configured as untagged for the 10.177.8.40 network and tagged for vlan 27 (10.177.27.0/24).
I've looked through the Cisco Press book and the online docs and followed everything mentioned. The behaviour of the failed pings is typical of devices configured without any default gateway. I would imagine the routing on the box should take care of that.
I've also tried enabling communication between interfaces with the same security level or between multiple hosts on the same interface.
Any help greatly appreciated.
It seems that issue is neither with the trunking, nor with the bug as mentioned previously on this post.
ASA is behaving as it is expected to. Let me explain.
Test interface connects directly to 10.177.27.0/24 network only. Then you have the route-
10.177.0.0 255.255.128.0 --> 10.177.8.46
Now you are initiating PING from 10.177.29.251, which as per the configuration of ASA is on the Native interface, because the above route points to 10.177.8.46, which is part of the Native interface.
So logically, your host which is on the Native interface, is trying to ping altogether a different interface of ASA. This is simply not possible. ASA does not allow to ping the other side interface from a host on a different interface. Please refer to following link for the same-
However, if you requirement is that 10.177.29.251 should be in vlan27, then we need to make configuration changes on the ASA.
Let me know if this explains the bhaviour of ASA. Hope this helps.