Solved: not able to ping or route internal ASA interface

jorgemneves · ‎07-18-2016

Hi,

This asa have two portchannel sub-interfaces.

admin interface and users interface

Not sure why but I am not able to ping users interface.

can you please advise

Thanks

Marius Gunnerud · ‎07-19-2016

management-access "interface" command is just used for management access over a VPN connection.

As for the RDP issue, sounds like you have asynchronous routing going on. I suggest you remove the VLAN interfaces from the switch and let the ASA do all the routing...or configure the switch with VRFs and let the ASA do all inter VLAN routing.

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts

View solution in original post

Marius Gunnerud · ‎07-18-2016

You would need to provide a full running configuration (please remove any passwords and public IPs) for us to have a better idea why it is not working.

Most common problem is for this is that icmp inspection is not enabled

policy-map global_policy
class inspection_default

inspec icmp

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts

jorgemneves · ‎07-18-2016

Thank you Marius,

I did tried that but it didn't work.

This has been fixed adding the following command "man interface"

But now I have another problem where when I try to rdp to a computer on that network it doesn't work. Routing is all manage on our HSRP L3 switch, it is also dhcp.

Gateway for the computer is ASA.

I am allowing everything but when I check the logs on ASA it shows deny tcp (no connection) sync ack.

I have a static route on ASA to the L3 switch 0.0.0.0 0.0.0.0 10.37.1.1

Can you please advise.

Thank you again

J

Marius Gunnerud · ‎07-19-2016

management-access "interface" command is just used for management access over a VPN connection.

As for the RDP issue, sounds like you have asynchronous routing going on. I suggest you remove the VLAN interfaces from the switch and let the ASA do all the routing...or configure the switch with VRFs and let the ASA do all inter VLAN routing.

--

Please remember to select a correct answer and rate helpful posts

--
Please remember to select a correct answer and rate helpful posts

jorgemneves · ‎07-20-2016

Hi Marius,

I was thinking in the same thing.

I have made the change and now I can remote to the PC.

I have removed the management access but I am still unable to ping or route ASA interface from other subnets.

I have attached the configuration

Thanks

J

procopius1980 · ‎07-20-2016

Forgive me for hijacking this discussion, but do you have any suggestions for my issue? They are at least somewhat similar in nature.

https://supportforums.cisco.com/discussion/13076661/cant-connect-radius-server-or-anything-inside-interface

Thanks,