cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
1967
Views
0
Helpful
2
Replies

ASA 5505 (8.4) 192.168.1.1/16 Subnetting issues

garfieldgroup
Level 1
Level 1

Hello,

I have an ASA 5505 and I would like to create two subnets on it, but I'm having trouble getting some resources on the second subnet exposed to the outside world.

The first subnet is located at the 192.168.1.x range, and the second is at the 192.168.50.x range.  I'm able to expose the Outlook Web Access server on the 192.168.1.x range just fine, I can't seem to expose the web server or VPN on the 192.168.50.x range.  I've tried fiddling with NAT and Access-Lists but I'm obviously missing something...here is my current config:

Result of the command: "show config"

: Saved

: Written by enable_15 at 12:20:13.608 UTC Tue Jul 16 2013

!

ASA Version 8.4(5)

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.1 255.255.0.0

!

interface Vlan2

nameif outside

security-level 0

ip address 173.15.x.202 255.255.255.0

!

ftp mode passive

object network obj_any

subnet 0.0.0.0 0.0.0.0

object network DEV

host 192.168.50.13

object network ODM

host 192.168.50.11

object network PR

host 192.168.1.2

access-list acl_out extended permit tcp any object DEV eq www

access-list acl_out extended permit tcp any object ODM eq pptp

access-list acl_out extended permit tcp any object PR eq https

access-list acl_out extended permit tcp any object PR eq pop3

access-list acl_out extended permit tcp any object PR eq imap4

access-list acl_out extended permit tcp any object PR eq smtp

pager lines 24

logging enable

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

no arp permit-nonconnected

!

object network DEV

nat (inside,outside) static interface service tcp www www

object network ODM

nat (inside,outside) static interface service tcp pptp pptp

object network PR

nat (inside,outside) static interface service tcp https https

!

nat (inside,outside) after-auto source dynamic any interface

access-group acl_out in interface outside

route outside 0.0.0.0 0.0.0.0 173.15.x.206 1

timeout xlate 3:00:00

timeout pat-xlate 0:00:30

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

user-identity default-domain LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart warmstart

telnet timeout 5

ssh timeout 5

ssh key-exchange group dh-group1-sha1

console timeout 0

dhcpd auto_config outside

!

dhcpd address 192.168.1.5-192.168.1.254 inside

!

threat-detection basic-threat

threat-detection statistics host

threat-detection statistics port

threat-detection statistics protocol

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

class class-default

  user-statistics accounting

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:13d83266ce5b0f932d9b184cd176a7be

Any suggestions are greatly appreciated.  Thanks!

2 Replies 2

eddie.harmoush
Level 1
Level 1

Hi Adam,

I'm not seeing where you created the VLAN Interface for your the 192.168.50.x subnet.  Nor am I seeing a route to the 192.168.50.x subnet, so I'm assuming you simply forgot to create it.

Your Firewall currently doesn't know how to get to the 192.168.50.x subnet, it either needs the interface created or a route statement added. 

Hope this helps.

-Eddie

Marvin Rhoads
Hall of Fame
Hall of Fame

In addition to Eddie's reply, your VLAN 1 has a /16 mask. Is that what you wanted?

That's a bit unusual (although it's the topic on the thread) and you have the http statement for ASDM management referring to the network as a /24.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: