Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Need assist in Config

Hello Experts,
I'm in process of configuring the firewall and switch model 2948G running on CAT OS where I configured sub interfaces and assigned the IP addresses and VLAN on firewall interface and the firewall port is connected with switch port which is a trunk port allowing all the VLAN traffic. Now when I connect any machine with any switch port member of VLAN 1 then I won't able to ping the gateway even I assigned the IP address from the same network of VLAN 1 to switch sc0 port that I can ping so most probably it looks the communication problem in between switch and firewall. The firewall model is asa 5510 with security plus license. Please assist in this and share your thoughts what could be a problem and how to resolve it. I'm not expert in CAT OS and having some problems to troubleshoot the issue.

Thanks

Sent from Cisco Technical Support iPhone App

8 REPLIES
New Member

Need assist in Config

Hi,

Please share your config file on both the device.

Regards

Pankaj

New Member

Need assist in Config

Please see the firewall config below which access I have it right now. the switch config I will send it later once my colleague reach at DC as the switch can be accessible via console:

:

ASA Version 8.2(5)

!

names

!

interface Ethernet0/0

nameif outside

security-level 0

ip address x.x.x.x 255.255.255.224

!

interface Ethernet0/1

no nameif

no security-level

no ip address

!

interface Ethernet0/2

no nameif

no security-level

no ip address

!

interface Ethernet0/3

<--- More --->

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface Redundant1

member-interface Ethernet0/1

member-interface Ethernet0/2

no nameif

no security-level

no ip address

!

interface Redundant1.1

description Management

vlan 1

nameif inside

security-level 100

ip address 10.1.10.1 255.255.255.0

<--- More --->

!

interface Redundant1.2

description DMZ Servers

vlan 2

nameif DMZ

security-level 50

ip address 10.1.12.1 255.255.255.0

!

interface Redundant1.3

description Infrastructure Servers

vlan 3

nameif Infra

security-level 60

ip address 10.1.14.1 255.255.255.0

!

interface Redundant1.4

description Database Servers

vlan 4

nameif database

security-level 90

ip address 10.1.16.1 255.255.255.0

!

boot system disk0:/asa825-k8.bin

ftp mode passive

<--- More --->

access-list dc_splitTunnelAcl standard permit 10.1.10.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.16.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.12.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.14.0 255.255.255.0

access-list inside_nat0_outbound_1 extended permit ip 10.1.10.0 255.255.255.0 192.168.11.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu DMZ 1500

mtu Infra 1500

mtu database 1500

ip local pool DC_Pool 192.168.11.100-192.168.11.254 mask 255.255.255.0

ip verify reverse-path interface outside

ip verify reverse-path interface inside

ip verify reverse-path interface DMZ

ip verify reverse-path interface Infra

ip verify reverse-path interface database

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

<--- More --->

nat (inside) 0 access-list inside_nat0_outbound_1

route outside 0.0.0.0 0.0.0.0 216.182.216.129 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

<--- More --->

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

management-access inside

threat-detection basic-threat

<--- More --->

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

<--- More --->

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous

call-home

<--- More --->

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:ff8c256c0925e4125da7163b1d08a5ba

:

Logoff

New Member

Re: Need assist in Config

Please see the switch config as well
!
#time: Fri Jul 5 2013, 12:54:28
!
#version 8.4(11)GLX
!
!

!
#dot1x
set feature dot1x-radius-keepalive disable
!
#system
set system name Switch-Primary
set system location
set system contact
!
#frame distribution method
set port channel all distribution mac both
!
#ip
set interface sc0 1 10.1.10.2/255.255.255.0 10.1.10.255

set interface sl0 down
set interface me1 down
set ip route 0.0.0.0/0.0.0.0 10.1.10.1
set ip alias default 0.0.0.0
!
#set boot command
set boot config-register 0xf
set boot system flash bootflash:cat4000-k9.8-4-11-GLX.bin
!
#multicast filter
set igmp filter disable
!
#module 1 : 0-port Switching Supervisor
!
#module 2 : 50-port 10/100/1000 Ethernet
set trunk 2/12 on dot1q 1-1005,1025-4094
end
Switch-Primary-> (enable)

New Member

Re: Need assist in Config

Please assist in this.
Thanks

Sent from Cisco Technical Support iPhone App

New Member

Re: Need assist in Config

so you you mean to say you are able to ping from switch when you giving ip address to the port SC0 ..right?

and when you connect any system to any port of VLAN 1 , its not pingable?

please provide details of vlan from switch. (Command is show vlan)

New Member

Re: Need assist in Config

No I'm not able to ping from switch to firewall but I can ping from switch to machine vice versa. Please note there is no VLAN configured and all ports are by default assigned to VLAN 1 except port 2/12 which is configured as a trunk port and connected with firewall port where the sub interfaces are configured including VLAN 1 and its IP address that I want to be ping from both switch and machine. Thanks

Sent from Cisco Technical Support iPhone App

New Member

Re: Need assist in Config

Chat with me vgupta1912@gmail.com to address this issue, if possible.

Sent from Cisco Technical Support iPhone App

New Member

Re: Need assist in Config

You will have to configure VLANs with their IP address in switch as well.

Regards

Pankaj

239
Views
3
Helpful
8
Replies