I'm setting up an ASA 5505 in transparent mode and can't pass layer 3 traffic between vlans. This is a simple config and I'm not sure why it's not working. Here's how I have the interfaces configured.
int Vlan 100
Security level 100
int Vlan 2
Security level 0
switchport access vlan 100
switchport access vlan 2
access-list 101 permit tcp any host x.x.x.x eq 443
access-list 101 deny ip any any log
access-group 101 in interface INSIDE
The documentation as well as the Cisco engineer assigned to my ticket, says that all I need to do is apply the access-list to the inside interface and layer 3 traffic should get bridged between the vlans but it hasn't worked. If I put both interfaces in the same vlan, obviously it works fine but as soon as I assign the interfaces to different vlans traffic can't pass through. I've tried creating two vlans with the same security level, with the command to permit same security level interfaces to communicate and traffic still doesn't bridge between vlans. When I look at the access list the hit count is 0. I've enabled logging at the debug level and nothing shows. This issue appears to be bridging between vlans. Supposedly, in order to pass layer 3 traffic all I need is an extended access-list but there's no info showing how the configuration should be. Any help would be appreciated.
Thanks for the reply. There's no acl on the outside int b/c the originating traffic is only going in one direction. The connection will be established from out private network out across a p2p link to a server in Detroit. The only traffic allowed back, will be an established connection. By the way, I did put an acl on the outside int just for the hell of it and still didn't work. As far as you know is there anything that would prevent a 5505 from bridging traffic between vlans?
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...