Hi Everyone. I have been working on a task for a few days now and cannot/do not understand why it is not working.
This is my first post so please be patient.
My employer has given me two ASA devices, a 5505 (ASA v8.4(7) and a 5510. I have basic firewall skills and I'm quite new to their full functionality.
Basically I am trying to route traffic from and back to HQ1 (main business entity) via R1 (Cisco 1841) through the ASA 5505 at the second site.
All connection are to be established from HQ1 to NEW site initially.
This is to allow staff access to the new site without having to come in via the internet service.
It is also to enable IT to control (via access lists on the ASA) who and what can access this new site from HQ1.
I have included a Network diag showing how the sites are connected and the static routes I have added.
As per my diag the ASA5505 inside Interface is pointing to HQ1. The outside interface is connected to a switch port on one of two L3 switches running VRRP.
The ASA5510 (internet facing) has it’s inside Interface connected to a switchport on the Second L3 switch.
Both switchports are set to switchport-access vlan 10 (production Vlan)
The Production network of the NEW site can get to and from internet as intended without a problem via the ASA5510.
What I CANNOT understand is why I can’t traceroute from HQ1 to the new site via ASA5505 and visa-versa.
I have tested Traceroute and pings from the ASA5505 Inside interface to HQ1 and all looks fine.I can ping servers in HQ1
The ASAs are not configured for Rip v2 as I was planning on adding static routes only.
Here are the route tables on both L3 switches and more of my testing follows
Switch-A#show ip route
Default Gateway is 172.17.10.2
S 0.0.0.0/0 [1/0] via 172.17.10.2, Vl10
S *.*.*.*/29 [1/0] via 172.17.10.2, Vl10 (DMZ)
C 172.17.10.0/24 [0/1] directly connected, Vl10
C 172.17.20.0/24 [0/1] directly connected, Vl20
C 172.17.100.0/24 [0/1] directly connected, Vl100
S 192.168.0.0/16 [1/0] via 172.17.10.1, Vl10
A tracert from a Srv1 on the NEW site to one on the HQ1 site stops at the Gateway of the server 192.168.10.254 (which is the VRRP redundant gateway for Vlan10)
Tracerote from either L3 switch towards next hope to HQ1 inside interface returns this.......
Switch-A#traceroute 192.168.0.29
Traceroute to 192.168.0.29 ,30 hops max 0 byte packets:
1 0.0.0.0 * * *
2 0.0.0.0 * *
Hop Count = 2 Last TTL = 2 Test attempt = 5 Test Success = 0
Firewall routes are below
ASA 5510
Sho Route
Gateway of last resort is *.*.*.2 to network 0.0.0.0
C *.*.*.96 255.255.255.248 is directly connected, DMZ
C *.*.*.1 255.255.255.252 is directly connected, outside
C 172.17.10.0 255.255.255.0 is directly connected, inside
S* 0.0.0.0 0.0.0.0 [1/0] via *.*.*.2, outside
ASA 5505
Sho Route
Gateway of last resort is not set
C 172.17.10.0 255.255.255.0 is directly connected, outside
C 192.168.0.28 255.255.255.252 is directly connected, inside
S 192.168.0.0 255.255.0.0 [1/0] via 192.168.0.29, inside
Do the ASAs need to be connected to interfaces on the same switch and not opposing switches?
I put them in opposite switches for a little redundancy.
Any suggestions and help would be greatly appreciated.
Many thanks,
Alan
