cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
776
Views
4
Helpful
3
Replies

Unable to ping (or connect) across network through Router/ASA

Thomas McLean
Level 1
Level 1

Guys,

 

I've built a lab in gns3, one router and one ASA, the ASA has an inside, DMZ (with a small network behind it with just 1 server up and running at present) and an outside interface whilst the router has 3 interfaces on 3 subnets that connect a PC in each of the subnets using VMWare.

 

I have attached a screenshot of my topology so that you better understand what I have done and included the config files. https://www.dropbox.com/s/zjag2pt2dgper9p/topology.png

 

Basically, what I am trying to achieve is be able to connect through a pc in say the HR subnet through to the webserver in the DMZ, the webserver is LAMP, which is a pre-built VMWare appliance that runs webservices and it's mainly to just test.

 

I'm obviously missing out somethign simple as I can see it trying to connect through the ASDM log messages. I have changed the firewall rules to reflect this but still no avail.

 

I would appreciate some assistance if someone could spare 5 mins, I would really appreciate it.

 

Thanks

 

Thomas.

3 Replies 3

Mike Williams
Level 5
Level 5

Hi Thomas,

Your R1 config is incomplete, so I'm basing this entirely on the ASA config. I would remove the global_access ACL and change the inside_access_in ACL to permit ip any any. Also make sure that the webserver has a default gateway of 192.168.70.10.

Make sure that R1 has the necessary routes to get to 192.168.100.0/24 subnet. 

Also keep in mind that I've seen strange behavior with the ASA in GNS3. It sometimes won't pass traffic like it's supposed to.

Regards,

Mike

Thanks for the reply Mike, I had put static routes from R1 pointing to the ASA and to the correct subnet...I will update the config later, but I am getting deny messages from the ASA basically saying it cannot see the route, as if it's trying to go out the outside interface...I believe it is something that I am doing wrong rather than GNS3.

 

I will try your suggestion tonight as I did notice last night that GNS3 wouldn't let me launch ASDM until the ASA was reloaded.

 

Thanks again,

 

Thomas.

Here is an update, I'm still confused to what I could be doing wrong:

I am chucking everything from the router over to the ASA with the static route below

R1#sh run | in ip route
ip route 0.0.0.0 0.0.0.0 192.168.100.1

 

Below is the interfaces on the ASA.

 

interface GigabitEthernet0
 nameif outside
 security-level 100
 ip address 192.168.0.100 255.255.255.0
!
interface GigabitEthernet1
 nameif inside
 security-level 100
 ip address 192.168.100.1 255.255.255.252
!
interface GigabitEthernet2
 nameif DMZ
 security-level 100
 ip address 192.168.70.10 255.255.255.0

 

 

access-group outside_access_in in interface outside
access-group inside_access_in in interface inside
access-group DMZ_access_in in interface DMZ
access-group global_access global

 

Static routes pointing over to the subnet via the DMZ gateway IP (I've also tried 192.168.70.1 with same issues)

route inside 192.168.10.0 255.255.255.0 192.168.70.10 1
route inside 192.168.20.0 255.255.255.0 192.168.70.10 1
route inside 192.168.30.0 255.255.255.0 192.168.70.10 1

I can ping the correct places directly from the ASA CLI without issues but when I try it from the ASDM on any interface it returns the dreaded ?????

ciscoasa# ping 192.168.70.128
Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.70.128, timeout is 2 seconds:
!!!!!
Success rate is 100 percent (5/5), round-trip min/avg/max = 1/1/1 ms

 

 

R1#ping 192.168.70.128

Type escape sequence to abort.
Sending 5, 100-byte ICMP Echos to 192.168.70.128, timeout is 2 seconds:
.....
Success rate is 0 percent (0/5)

 

And here is the pictures to ASDM, I have configured the ACL's in that way to prove that all interfaces allow EVERYTHING, I have also tried many other ACL methods but still no luck.

https://www.dropbox.com/s/feacsynralx68ok/ASAIssues.png

 

Thanks for all the help so far everyone but if anyone else can assist I would really appreciate it.

 

Thanks,

 

Thomas.

 

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: