Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Routing between interfaces on ASA 5520

Hi,

We have an ASA 5520 which is in multiple context mode.

We are trying to pass traffic from the outside interface to the dmz interface.

I may be fundamentally wrong in the way i'm configuring this, but this is one ting im hoping someone may be able to help with. We have a /27 public ip range. We need a small amount of those addresses to be in the DMZ for SIP servers specifically. The rest of the addresses are NAT'd to the inside interface.

So i created the outside interface GigabitEthernet0/0 with 1.2.3.192/28

Inside Interface GigabitEthernet0/2 with 192.168.20.0/24

DMZ interface on GigabitEthernet0/2.1 with 1.2.3.208/29

So all i want to do is route traffic that comes in the outside interface and out to the DMZ interface for the 1.2.3.208/29 subnet. I set the gateway address as 1.2.3.214 which is the DMZ interface address on the ASA.

I hope this makes sense? Im sure im doing something stupid, im just stuck, and hoping someone can help.

I can provide more info if required.

Thanks

Birdy

Everyone's tags (3)
20 REPLIES
VIP Purple

Routing between interfaces on ASA 5520

That really should work. There are some things you should be aware of:

- If your g0/0 is a shared interface you should enable individual MAC-addresses per context so that the ASA can classify the traffic.

- Using a native VLAN on an interface that is also handling subinterfaces is not seen as a best practice. Better use only subinterfaces and the major interfaces should not be configured with any firewalling-settings.

- Your ACLs allow the traffic from outside to DMZ?

- If you still have nat-control enabled (you didn't write which version you are using), then you need a nat-config (nat-exemption) also for the communication between interfaces with public IP addresses.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

Thanks for your reply.

g0/0 isnt a shared interface.

I'll look into the sub-interfaces, thanks for the tip.

Yes i have ACL's allowing traffic outside to DMZ

Im not sure how to configure the NAT exemption rules? Version 8.2

Im sure i disabled nat-control. Do you know how i can check? I cant find in my config.

Thanks again

VIP Purple

Re: Routing between interfaces on ASA 5520

what is the output of:

show run nat

show run nat-control

show run static


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

sh run nat:

nat (outside) 0 access-list outside_nat0_outbound outside

sh run nat-control:

no nat-control

sh run static:

Has static NAT definitions, none of which map to DMZ, only to management interfaces currently. There are static routes which are:

0.0.0.0 0.0.0.0 1.2.3.193

192.168.20.0 255.255.255.0 192.168.20.254

Thanks

VIP Purple

Re: Routing between interfaces on ASA 5520

what is your NAT-exemption on your outside-interface for? There could be something involved that drops your traffic.

Try the packet-tracer to simulate your traffic.


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Apologies. I had not considered that i was sharing an interface between the admin context and the main context. submitted the mac-address auto command in the system context which has resolved this particular issue, although it does lock me out of the admin context!

Apologies again for missing the interface sharing, i know you pointed that out at the beginning and i just missed it.

Thank you for your time and help

Chris

VIP Purple

Routing between interfaces on ASA 5520

No problem. But your admin-context should of course still work after that change. Any nearby devices with static arp-entries or L2-security enabled?


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

Sorry, i was away on another project.

Im still having the problem where i cant connect to the admin context if i enable mac-address auto to solve the previous problem.

I do have a Cisco 1921 in front, i havent added any L2 security unless it is on by default. I do notice that the mac address for the admin context changes when i do a sh arp on the 1921, so the address for .194 (admin context ip address) is a different mac-address to .195 (which is the other context). Both go to the g0/0

Im sure im missing  something obvious again, but im just not sure what it is.

Thanks

Chris

Routing between interfaces on ASA 5520

Hi Bro

This is how I would do it, if I were you. In your Cisco ASA (multi-context mode), you will have 3 contexts namely ADMIN CONTEXT, C1 CONTEXT and C2 CONTEXT. I would then allocate Management0/0 to ADMIN CONTEXT, GE0/0 and GE 0/1 to C1 CONTEXT and GE 0/2 and GE0/3 to C2 CONTEXT.

C1 CONTEXT = Catered for INSIDE LAN users

C2 CONTEXT – Catered for DMZ Servers

In C1 CONTEXT, GE0/0 will hold the Public IP for example 202.188.1.2/27 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/1 will hold the Private IP Address 192.168.20.1/24.

Meanwhile in C2 CONTEXT, GE0/2 will hold the Public IP for example 202.188.1.3/27 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/3 will hold the Private IP Address 192.168.30.1/24.

Next, in the C2 context, for all network traffic coming from the Internet to the DMZ Servers, you’ll need to enable static NAT e.g. 202.188.1.30 ••à 192.168.30.30. Please do ensure your Cisco Router has a host route for this entry.

Finally, for outbound traffic in C1 and C2, you could apply dynamic NAT instead, translate to the respective context’s OUTSIDE interface.

There are other factors to look into as well, e.g. ACL, routing etc. If you’d like, you could paste your configuration here, and I could advice further.

You’re in safe hands, as I’ve carried out many such deployments in the past.

Warm regards, Ramraj Sivagnanam Sivajanam Technical Specialist/Service Delivery Manager – Managed Service Department
New Member

Routing between interfaces on ASA 5520

Hi,

Unfortunately we cannot use NAT, we run OpenSIP/Asterisk servers from the DMZ and NAT causes too many problems with SIP we've found.

I see what saying about the contexts though.

Thanks

Routing between interfaces on ASA 5520

Hi Bro

If you want to have Public IP Address in your DMZ LAN, that's fine too :-) This means you'll need to breakdown the /27 to 2 /28. 1 /28 will be used on the OUTSIDE interface and the other /28 will be used in DMZ.

In C1 CONTEXT, GE0/0 will hold the Public IP for example 202.188.1.2/28 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/1 will hold the Private IP Address 192.168.20.1/24.

Meanwhile in C2 CONTEXT, GE0/2 will hold the Public IP for example 202.188.1.3/28 (default gateway is 202.188.1.1 i.e. Cisco Router 1921 LAN interface) and GE0/3 will hold the Private IP Address 202.188.1.17/28.

Next, in the C2 context, for all network traffic coming from the Internet to the DMZ Servers, you’ll need to either enable no nat-control or static(dmz,outside) 202.188.1.16 202.188.1.16 netmask 255.255.255.240 . Please do ensure your Cisco Router has the proper route for this entry i.e. ip route 202.188.1.16 255.255.255.240 202.188.1.3 name DMZ_SERVERS

Finally, for outbound traffic C2, you can just forward them either via nat (dmz) 0 access-list nonat or the same way as done in C1.

Good luck bro! May the force be with you :-)

P/S: If you think this comment is helpful, please do rate it nicely :-)

You’re in safe hands, as I’ve carried out many such deployments in the past.

Warm regards, Ramraj Sivagnanam Sivajanam Technical Specialist/Service Delivery Manager – Managed Service Department
New Member

Routing between interfaces on ASA 5520

Thanks again.

Only issue is that the 1921 has only 2 interfaces. One is for the internet connection and the other connects to the ASA.

Thanks

Chris

Routing between interfaces on ASA 5520

Hi Bro

Your Cisco Router 1921 has 2 interfaces, that's fine. In fact, that's all we need. The LAN interface will hold the IP Address 202.188.1.1/28 and the C1 OUTSIDE CONTEXT IP Address will be 202.188.1.2/28 and C2 OUTSIDE CONTEXT IP Address will be 202.188.1.3/28 :-)

Warm regards, Ramraj Sivagnanam Sivajanam Technical Specialist/Service Delivery Manager – Managed Service Department
New Member

Routing between interfaces on ASA 5520

Ahhh sorry, i see now.

Ok i'll have a look.

I'll let you know how i get on.

Thanks!

Chris

VIP Purple

Routing between interfaces on ASA 5520

personally, I wouldn't change my infrastructure just because one feature doesn't work as expected. Better look for the couse of the problem. After changing the MAC-addresses on the ASA, have you tried to clear the arp-cache on the router?


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

Having had a look, my configuration doesnt differ much from what was suggested anyway.

Yes i have cleared the arp cache on the router after changing the mac-addresses.

Thanks

Chris

VIP Purple

Re: Routing between interfaces on ASA 5520

so from the standpoint of the adjacent router it looks fine with the different MAC-addresses. Please explain what you mean with "locked out of the admin context". What exactly desn't work?


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

Thanks for the replies.

I cannot connect on ASDM, SSH or telnet to the .194 address. Nor can i ping etc. So i cant manage the ASA when mac-address auto is applied. (I schedule a reload before i apply this).

So even though the router is showing a different mac-address in it's arp table, the ASA wont accept connections on the admin context and that IP address. I cant thknk of anything in the ASA that i've configured that would block/filter on L2.

Thanks

Chris

VIP Purple

Routing between interfaces on ASA 5520

Anything on the Switch between the ASA and the Router?


--
Don't stop after you've improved your network! Improve the world by lending money to the working poor: http://www.kiva.org/invitedby/karsteni
New Member

Routing between interfaces on ASA 5520

Hi,

Theres no switch between the router and the firewall. If i explain the topology a bit more that might help.

Internet > Cisco 1921 > ASA 5520 > Dell Blade, Poweredge Switch M6348.

The switch has 2 vlans, one for 192.168.20.0/24 network. The other is the DMZ, 1.2.3.208/29

The ASA has 2 contexts, admin, interface Gi0/0 1.2.3.194/29

ctx1 interface Gi0/0 1.2.3.195/28 - nameif outside

Interface G0/1 10.10.10.1/25 - nameif CMC (Management for blades)

Interface Gi0/2 192.168.20.254/24 nameif inside

Interface Gi0/2.1 1.2.3.208/29 nameif DMZ

I was primarily using NAT to reach various servers/management interfaces on the inside an CMC interfaces. Which worked fine, however we needed a publicly addressable space to run a SIP server and possibly some more things to come. Which is where the DMZ came from. However as the admin context and ctx1 share interface Gi0/0 and i need to route part of the public subnet to the DMZ i found i needed to turn on mac-address auto in the system context. This allows the NAT and the DMZ to work, however i cant access the admin context, The arp-cache updates immediately on the router so it sees the change but i just wonder if its something on the ASA that cannot accept traffic on that Mac-address?

Sorry for the long winded explanation, i hope this makes sense.

Thanks

Chris

2086
Views
0
Helpful
20
Replies