05-25-2014 05:53 PM - edited 03-11-2019 09:14 PM
Hi Everyone,
Here is setup
Switch -------------------------ASA1----Active
ASA1----Standby
ASA is config as Active/Standby
ASA has dhcp config that provides PC with IP 10.0.0.11
From Switch i can ping my PC
1#ping 10.0.0.11
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.11, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/6/9 ms
Switch info
1#sh ip int brief
Interface IP-Address OK? Method Status Protocol
Vlan1 10.0.0.4 YES NVRAM up up
FastEthernet1/0/1 unassigned YES unset up up
FastEthernet1/0/2 unassigned YES unset up up
FastEthernet1/0/3 unassigned YES unset down down
FastEthernet1/0/4 unassigned YES unset down down
FastEthernet1/0/5 unassigned YES unset down down
FastEthernet1/0/6 unassigned YES unset down down
FastEthernet1/0/7 unassigned YES unset down down
FastEthernet1/0/8 unassigned YES unset down down
FastEthernet1/0/9 unassigned YES unset down down
FastEthernet1/0/10 unassigned YES unset down down
FastEthernet1/0/11 unassigned YES unset down down
FastEthernet1/0/12 unassigned YES unset down down
FastEthernet1/0/13 unassigned YES unset down down
FastEthernet1/0/14 unassigned YES unset down down
FastEthernet1/0/15 unassigned YES unset down down
FastEthernet1/0/16 unassigned YES unset down down
FastEthernet1/0/17 unassigned YES unset down down
FastEthernet1/0/18 unassigned YES unset down down
FastEthernet1/0/19 unassigned YES unset down down
FastEthernet1/0/20 unassigned YES unset down down
FastEthernet1/0/21 unassigned YES unset down down
FastEthernet1/0/22 unassigned YES unset down down
FastEthernet1/0/23 unassigned YES unset down down
FastEthernet1/0/24 unassigned YES unset down down
GigabitEthernet1/0/1 unassigned YES unset administratively down down
GigabitEthernet1/0/2 unassigned YES unset administratively down down
Loopback0 10.1.0.1 YES NVRAM up up
Loopback1 10.1.1.1 YES NVRAM up up
Loopback2 10.1.2.1 YES NVRAM up up
Loopback3 10.1.3.1 YES NVRAM up up
Loopback4 10.1.4.1 YES NVRAM up up
Loopback5 10.1.5.1 YES NVRAM up up
Loopback6 10.1.6.1 YES NVRAM up up
Loopback7 192.168.50.1 YES NVRAM up up
Loopback8 unassigned YES NVRAM up up
R1#
ASA has Vlan 1 as inside interface with IP 10.0.0.1 and has direct connection to switch on vlan 1.
From ASA i can ping the 10.1.0.1
ASA1# ping 10.1.0.1
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.1.0.1, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/2/10 ms
From PC i can not ping IP 10.1.0.1
Logs from ASA
May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1
May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1
ASA info
ASA1# sh int
ASA1# sh interface ip brief
Interface IP-Address OK? Method Status Protocol
Ethernet0/0 unassigned YES unset up up
Ethernet0/1 unassigned YES unset up up
Ethernet0/2 unassigned YES unset up up
Ethernet0/3 unassigned YES unset down down
Ethernet0/4 unassigned YES unset up up
Ethernet0/5 unassigned YES unset up up
Ethernet0/6 unassigned YES unset administratively down down
Ethernet0/7 unassigned YES unset administratively down down
Internal-Data0/0 unassigned YES unset up up
Internal-Data0/1 unassigned YES unset up up
Vlan1 10.0.0.1 YES CONFIG up up
Vlan2 96.x.x.x. YES manual up up
Vlan3 10.12.12.1 YES CONFIG up up
Vlan30 10.30.30.1 YES unset up up
Virtual0 127.1.0.1 YES unset up up
Need to know why this ping is not working is this due to NAT also why ASA is looking for loopback IP of switch in outside direction?
Regards
MAhesh
Solved! Go to Solution.
05-27-2014 10:02 AM
It looks like the issue is that PC, switch and ASA are in the same network (10.0.0.0/24)
As far as I know, ASA does not send ICMP redirect messages; you can add a static route on the PC for the network 10.1.0.0 to go directly to switch instead of ASA; that will solve the issue for that PC only.
I think the best practice is to create a routing subnet between the switch and ASA:
PC - SWITCH in VLAN1
SWITCH - ASA in a new VLAN used for routing
that means you have to make the switch your default gateway for VLAN1 and change the IP of the inside interface of the ASA + change the routes...
check this link to understand ICMP redirects:
http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html
other forum posts discuss the same issue:
https://supportforums.cisco.com/discussion/11229301/icmp-redirect
Patrick
05-28-2014 07:40 AM
05-26-2014 11:18 AM
Hi Mahesh,
what's your netmask on VLAN1?
you can try from the switch ping 10.0.0.11 source Lo0; does that work?
also please attach show route on ASA and switch (if it is a layer 3 switch)...
Patrick
05-26-2014 11:26 AM
Hi Patrick,
Vlan1 has netmask 255.255.255.0
1#ping 10.0.0.14 source loopback 0
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 10.0.0.14, timeout is 2 seconds:
Packet sent with a source address of 10.1.0.1
.....
Success rate is 0 percent (0/5)
Above is ping from Switch to PC IP
Switch is layer 3
1#sh int vlan1
Vlan1 is up, line protocol is up
Hardware is EtherSVI, address is 0011.bb5e.e240 (bia 0011.bb5e.e240)
Internet address is 10.0.0.4/24
Route info
1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.1 to network 0.0.0.0
10.0.0.0/24 is subnetted, 8 subnets
C 10.1.3.0 is directly connected, Loopback3
C 10.1.2.0 is directly connected, Loopback2
C 10.1.1.0 is directly connected, Loopback1
C 10.0.0.0 is directly connected, Vlan1
C 10.1.0.0 is directly connected, Loopback0
C 10.1.6.0 is directly connected, Loopback6
C 10.1.5.0 is directly connected, Loopback5
C 10.1.4.0 is directly connected, Loopback4
C 192.168.50.0/24 is directly connected, Loopback7
S* 0.0.0.0/0 [1/0] via 10.0.0.1
ASA1# sh run route
route outside 0.0.0.0 0.0.0.0 96.51.148.1 1
route inside 10.1.0.0 255.255.0.0 10.0.0.4 1
route inside 192.168.50.0 255.255.255.0 10.0.0.4 1
Regards
Mahesh
05-26-2014 01:19 PM
Mahesh,
What's the default gateway for the PC? ("route print" from command prompt if it's a Windows host)
If it's not 10.0.0.1 on the ASA then your ping will fail.
05-26-2014 01:24 PM
Hi Marvin,
PC has default gateway of 10.0.0.1
Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\manveer>route print
===========================================================================
Interface List
25...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter #2
23...74 e5 0b 5b e7 89 ......Microsoft Virtual WiFi Miniport Adapter
21...74 e5 0b 5b e7 88 ......Intel(R) WiFi Link 1000 BGN
13...f0 bf 97 de 4f 48 ......Atheros AR8151 PCI-E Gigabit Ethernet Controller (
NDIS 6.20)
12...94 39 e5 97 60 b5 ......Bluetooth Device (Personal Area Network)
1...........................Software Loopback Interface 1
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 10.0.0.1 10.0.0.14 25
10.0.0.0 255.255.255.0 On-link 10.0.0.14 281
10.0.0.14 255.255.255.255 On-link 10.0.0.14 281
10.0.0.255 255.255.255.255 On-link 10.0.0.14 281
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 10.0.0.14 281
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 10.0.0.14 281
===========================================================================
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.98.1 Default
===========================================================================
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
1 306 ::1/128 On-link
21 281 fe80::/64 On-link
21 281 fe80::f54f:db1d:f86:1184/128
On-link
1 306 ff00::/8 On-link
21 281 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
C:\Users\manveer>ipconfig
Windows IP Configuration
Wireless LAN adapter Wireless Network Connection 3:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Wireless LAN adapter Wireless Network Connection 2:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Wireless LAN adapter Wireless Network Connection:
Connection-specific DNS Suffix . :
Link-local IPv6 Address . . . . . : fe80::f54f:db1d:f86:1184%21
IPv4 Address. . . . . . . . . . . : 10.0.0.14
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.1
Ethernet adapter Local Area Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Ethernet adapter Bluetooth Network Connection:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Regards
Mahesh
05-26-2014 01:40 PM
try removing the persistent default route:
Persistent Routes:
Network Address Netmask Gateway Address Metric
0.0.0.0 0.0.0.0 192.168.98.1 Default
05-26-2014 02:29 PM
Delete the persistent route and did ping to 10.1.0.1 still same thing.
Logs from ASA
May 26 2014 15:15:08: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1
May 26 2014 15:15:10: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.14/1 laddr 10.0.0.14/1
05-26-2014 04:52 PM
I think you are getting asymmetric routing since the switch is the same place your PC is attached.
Your PC pings an address on the 10.1.0.0 network. It sends it to the ASA (default gateway). ASA has a static route to that network so it sends the packet back to the switch. The switch receives the echo request and then creates a reply to the PC. At this point I believe the reply does not go via the ASA but instead tries and fails to go back to the PC via the switch's 10.0.0.4 address since a connected route takes priority over a static route (given the same prefix).
Try adding a static route in the switch to your PC address:
route 10.0.0.14 255.255.255.255 10.0.0.1
That should force the return traffic via the ASA. Make sure you have "same-security-traffic intra-interface" enabled on the ASA.
05-26-2014 05:19 PM
I config static route on switch
1#sh ip route
Codes: C - connected, S - static, R - RIP, M - mobile, B - BGP
D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
E1 - OSPF external type 1, E2 - OSPF external type 2
i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
ia - IS-IS inter area, * - candidate default, U - per-user static route
o - ODR, P - periodic downloaded static route
Gateway of last resort is 10.0.0.1 to network 0.0.0.0
10.0.0.0/8 is variably subnetted, 9 subnets, 2 masks
S 10.0.0.14/32 [1/0] via 10.0.0.1
C 10.1.3.0/24 is directly connected, Loopback3
C 10.1.2.0/24 is directly connected, Loopback2
C 10.1.1.0/24 is directly connected, Loopback1
C 10.0.0.0/24 is directly connected, Vlan1
C 10.1.0.0/24 is directly connected, Loopback0
C 10.1.6.0/24 is directly connected, Loopback6
C 10.1.5.0/24 is directly connected, Loopback5
C 10.1.4.0/24 is directly connected, Loopback4
C 192.168.50.0/24 is directly connected, Loopback7
S* 0.0.0.0/0 [1/0] via 10.0.0.1
ASA is configured for same-security-traffic.
Still same thing.
After adding route to switch i can not ping or telnet to switch IP 10.0.0.4 from
my pc.
05-27-2014 05:13 AM
I agree with Marvin that this seems to be an asynchronous routing issue. I do not think adding a static route will help, as connected routes will take precedence over the static route, and you will still have the same asynchronous routing issue.
Trying issuing a packet capture on the ASA for both the ingress and egress interfaces. This should clear up if the return packets are reaching the ASA or not. Post the output here if you require assistance with reading it.
--
Please remember to select a correct answer and rate
05-27-2014 05:49 AM
Hi MArius,
I config packet capture on inside interface
here is output
ASA1# sh capture capin
4 packets captured
1: 06:44:46.747169 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re quest
2: 06:44:51.627378 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re quest
3: 06:44:56.635724 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re quest
4: 06:45:01.641995 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo re quest
After this i also config packet capture for outside interface
capture capin interface outside match ip host 10.0.0.18 host 10.1.0.1
ASA1# sh capture capin
12 packets captured
1: 06:44:46.747169 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
2: 06:44:51.627378 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
3: 06:44:56.635724 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
4: 06:45:01.641995 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
5: 06:46:03.760153 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
6: 06:46:03.760489 802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
7: 06:46:08.639340 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
8: 06:46:08.639676 802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
9: 06:46:13.636380 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
10: 06:46:13.636716 802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
11: 06:46:18.627775 802.1Q vlan#1 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
12: 06:46:18.628126 802.1Q vlan#2 P0 10.0.0.18 > 10.1.0.1: icmp: echo request
What does the above packet capture show?
Regards
MAhesh
05-27-2014 06:09 AM
This confirms Marvins, and mine, theory that the ASA never sees the return packet from the switch. Then when the PC sends another ICMP packet, the ASA sees that the packet is out of order and drops it as a spoofed packet.
You could configure the ASA for TCP bypass, but it is not a recommended solution and if you do not have a direct requirement to be able to ping or reach the loopback you should not implement it.
http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/conns_tcpstatebypass.html
--
Please remember to select a correct answer and rate
05-27-2014 07:58 AM
Hi Marius,
I am trying to understand the packet flow from PC to switch loopback.
Seems as per logs ASA is looking for Switch loopback IP in outside direction right?
May 25 2014 18:40:33: %ASA-6-302020: Built outbound ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1
May 25 2014 18:40:35: %ASA-6-302021: Teardown ICMP connection for faddr 10.1.0.1/0 gaddr 10.0.0.11/1 laddr 10.0.0.11/1
So ASA is sending packet in outside direction instead of inside right?
As there is no host on outside connection thats the reason ping is not working?
Regards
MAhesh
05-27-2014 10:02 AM
It looks like the issue is that PC, switch and ASA are in the same network (10.0.0.0/24)
As far as I know, ASA does not send ICMP redirect messages; you can add a static route on the PC for the network 10.1.0.0 to go directly to switch instead of ASA; that will solve the issue for that PC only.
I think the best practice is to create a routing subnet between the switch and ASA:
PC - SWITCH in VLAN1
SWITCH - ASA in a new VLAN used for routing
that means you have to make the switch your default gateway for VLAN1 and change the IP of the inside interface of the ASA + change the routes...
check this link to understand ICMP redirects:
http://www.cisco.com/c/en/us/support/docs/ip/routing-information-protocol-rip/13714-43.html
other forum posts discuss the same issue:
https://supportforums.cisco.com/discussion/11229301/icmp-redirect
Patrick
05-28-2014 07:08 AM
Hi Patrick,
when i assigned static route to PC as you said then ping worked fine.
If you can explain me how traffic flows from PC to Switch ?
Learned something new today.Will read about ICMP redirects and will have better understanding then.
Best Regards
MAhesh
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide