Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

ASA5505 - static route is not working

Hello everyone,

I've got two internal networks which belong to the inside vlan (or I guess it is) : 10.0.0.0/24 and 192.168.2.0/24.

The IP address of my ASA is 10.0.0.1 and the router used to make the two networks talk has got two interfaces 10.0.0.42 and 192.168.2.1.

Thanks to the route command, the ASA should redirect the packets for 192.168.2.0 to 10.0.0.42 and it will manage to give them to the other network.

Here is my config :

: Saved

:

ASA Version 8.2(5)

!

hostname Cisco-ASA-5505

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.1.254 255.255.255.0

!

ftp mode passive

clock timezone GMT 1

access-list NONAT extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool VPNpool 10.0.1.1-10.0.1.50

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list NONAT

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

route inside 192.168.2.0 255.255.255.0 10.0.0.42 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set RA-TS esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map DYN-MAP 10 set transform-set RA-TS

crypto map VPN-MAP 30 ipsec-isakmp dynamic DYN-MAP

crypto map VPN-MAP interface outside

crypto isakmp enable outside

crypto isakmp policy 20

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 3600

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 10.0.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd address 10.0.0.10-10.0.0.40 inside

dhcpd dns 81.253.149.9 80.10.246.1 interface inside

dhcpd update dns both override interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

tftp-server inside 10.0.0.42 /srv/tftp/cisco-rtr-01-config

webvpn

username admin password 4RdDnLO1w29lihWc encrypted

username cld password zGOnThs6HPdAZhqs encrypted

tunnel-group synvpn type remote-access

tunnel-group synvpn general-attributes

address-pool VPNpool

tunnel-group synvpn ipsec-attributes

pre-shared-key *****

!

!

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:c3d233f44e742110aa0ce1f81173d47c

: end

I can ping the router through the IP address 10.0.0.42 but not with the other one : 192.168.2.1. Do you know why I can't talk to this network even if I defined a route ?

Thanks !

John

13 REPLIES
Purple

ASA5505 - static route is not working

Hi John,

Can you provide the config of the router please.

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

ASA5505 - static route is not working

It is a Debian machine with routing functinality activated and 2 interfaces, so it simply route

New Member

ASA5505 - static route is not working

If I execute the command "tracert 192.168.2.1" from my laptop (IP : 10.0.0.10), I get a time out

If I try to ping it, I get also a time out.

I don't understand why the command "route inside 192.168.2.0 255.255.255.0 10.0.042 1" is not working, it's quite simple.

My laptop will talk to the ASA, packets will be forwarded to the router (10.0.0.42) and its second interface will get them (192.168.1.1).

I need help please.

Purple

ASA5505 - static route is not working

Hi,

you're talking about 192.168.2.0  subnet but then talk about 192.168.1.1, is this a typo ?

Also for your laptop in 10.0.0.0 subnet I suppose the default-gateway is the ASA which then sends out to the Linux router ?

So you enter the inside interface and go back the same interface to get to the linux box ?

Can you do this :

same-security-traffic  permit intra-interface  in global config

Regards

Alain

Don't forget to rate helpful posts.

Don't forget to rate helpful posts.
New Member

ASA5505 - static route is not working

Hi Alain,

My mistake, the IP address of the Linux router is 192.168.2.1/24.

You are right, my laptop gets all the DHCP information from ASA so my default gateway is the ASA.

Yes I enter the inside interface and go bakc to it.

I tried to execute the command "same-security-traffic permit intra-interface" but unfortunately, it didn't change anything.

When I try to reach a web service with the IP address 192.168.2.2, Firefox tells methat the "connection has been reset".

When I do a ping to 192.168.2.1, I can see ping requests in Wireshark but no reply, and no error message.

New Member

Re: ASA5505 - static route is not working

if your network is like below

then you are having asymmetric routing and connection won't work when there is a firewall in the path. to verify it you could add a static route in your laptop with this command: route 192.168.2.0 mask 255.255.255.0 10.0.0.42 if asymmetric routing is the case then this command would bring your laptop's connection back to normal.

but as you said you can't get any reply while capturing in wireshark, then i think the problem is due to debian machine's ip forwarding. run below command and see if you can get 1 for result:

cat /proc/sys/net/ipv4/ip_forward

also try this from debian:

ping -I 10.0.0.42 192.168.2.2

ping 192.168.2.2

Message was edited by: Thomas Fan

New Member

Re: ASA5505 - static route is not working

Thanks Thomas,

Yes my network is like your schema.

I've added the route on y machine and it is working. But I can't add static routes to every device on my network, I have to make it work through the ASA.

The ip_forward file contains 1 and all the ping commands are working.

Do you know what I could do please ? I don't understand why the firewall (the ASA ?) is making problem and why it is an asymmetric routing.

New Member

ASA5505 - static route is not working

I would suggest to enable a unused port in firewall, assign it with ip address 192.168.2.1 and plug debian machine's LAN cable into this port. this would make your firewall also acting as a router+firewall between 10.0.0.0 network and 192.168.2.0 network. If you have problem with this solution please let me know.

New Member

ASA5505 - static route is not working

Thanks, I'll try your solution.

But I understand why packets would lose themselves, the default gw of the debian is the ASA, my laptop's default gw is the ASA, they can't go through an other router to come back. It's the only way.

New Member

ASA5505 - static route is not working

Unfortunately I don't have the license which allow me to have a third vlan.

Is there any solution to solve the asymmetric routing problem please ?

New Member

ASA5505 - static route is not working

I've connected the Debian machine directly to the ASA on Ethernet 0/3 which is inside, so into vlan 1.

It has got a new IP from the ASA 10.0.0.12 so I added the route :

route inside 192.168.2.0 255.255.255.0 10.0.0.12

But I still have the same problem : when I try to reach 192.168.2.1, I get a time out

Can somebody help me please ?

New Member

ASA5505 - static route is not working

Here are some news :

1) I've connected the Debian machine directly to port 0/2 of ASA5505

2) I've change IP address of Debian machine from 10.0.0.12 to 192.168.2.253. Now I've got one interface with this IP (ASA's side) and an other interface with the IP 192.168.2.1 (my subnetwork's side).

I can ping 192.168.2.1, 192.168.2.2, 192.168.2.253 from the Debian machine but not 192.168.1.254 (ASA's IP)

3) Here is my conf :

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

switchport access vlan 3

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.1.254 255.255.255.0

!

interface Vlan3

no nameif

security-level 100

ip address 192.168.2.254 255.255.255.0

!

ftp mode passive

clock timezone GMT 1

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list NONAT extended permit ip 10.0.0.0 255.255.255.0 10.0.1.0 255.255.255.0

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

ip local pool VPNpool 10.0.1.1-10.0.1.50

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 0 access-list NONAT

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set RA-TS esp-aes-256 esp-sha-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map DYN-MAP 10 set transform-set RA-TS

crypto map VPN-MAP 30 ipsec-isakmp dynamic DYN-MAP

crypto map VPN-MAP interface outside

crypto isakmp enable outside

crypto isakmp policy 20

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 3600

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 10.0.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd address 10.0.0.10-10.0.0.40 inside

dhcpd dns 81.253.149.9 80.10.246.1 interface inside

dhcpd update dns both override interface inside

dhcpd enable inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy company-vpn-policy internal

group-policy company-vpn-policy attributes

vpn-idle-timeout 30

username admin password 4RdDnLO1w29lihWc encrypted

tunnel-group synvpn type remote-access

tunnel-group synvpn general-attributes

address-pool VPNpool

tunnel-group synvpn ipsec-attributes

pre-shared-key *******

!

!

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:de6c2ff205906041c8ce435c5bcfd070

: end

Did I miss something to get it work ?

New Member

ASA5505 - static route is not working

Hi John,

if you don't have license to create a third vlan or enable a third port then a way to workaround this i know is to change the default gateway for 10.0.0.0/24 network from ASA to your Debian machine (all other configurations/settings/cablings be like your oringinal post). also, don't forget to setup a default gateway to ASA in your Debian machine if you try this.

BTW, are you able to ping 10.0.0.1 from 10.0.0.0/24 network? or are you able to ping 192.168.2.254 from 10.0.0.0/24 network?

2775
Views
0
Helpful
13
Replies