Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements
Webcast-Catalyst9k
New Member

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Hi,

i have a cisco ASA 5510 and need to be able to have 2 subnet communicate with each other.

Ethernet 0/0 is the outside connection

Ethernet 0/1 in the main inside connection 192.168.32.x

Ethernet 0/2 is the 2nd inside connection 192.168.33.x

Both int 1 and 2 can connect to the internet but they cannot communicate with each other.

Please help?!?!

Thanks

Christian

The running config is listed below:

: Saved

:

ASA Version 8.2(5)

!

hostname ciscoasa

enable password H4jV5cejsN/7lxxb encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

name 192.168.15.0 Warehouse description Warehouse

!

interface Ethernet0/0

nameif outside

security-level 0

ip address 195.171.223.67 255.255.240.0

!

interface Ethernet0/1

nameif inside

security-level 100

ip address 192.168.32.233 255.255.255.0

!

interface Ethernet0/2

nameif inside2

security-level 100

ip address 192.168.33.1 255.255.255.0

!

interface Ethernet0/3

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive

dns domain-lookup outside

dns server-group DefaultDNS

name-server 8.8.8.8

same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

access-list outside_cryptomap extended permit ip 192.168.32.0 255.255.255.0 Warehouse 255.255.255.0

pager lines 24

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu inside2 1500

mtu management 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

nat (inside2) 1 0.0.0.0 0.0.0.0

static (inside,inside2) 192.168.33.0 192.168.32.0 netmask 255.255.255.0

route outside 0.0.0.0 0.0.0.0 195.171.223.65 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

http server enable

http 192.168.32.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto map outside_map0 1 match address outside_cryptomap

crypto map outside_map0 1 set peer 81.137.231.247

crypto map outside_map0 1 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map0 1 set phase1-mode aggressive

crypto map outside_map0 interface outside

crypto isakmp enable outside

crypto isakmp enable inside

crypto isakmp policy 10

authentication crack

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 20

authentication rsa-sig

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 30

authentication pre-share

encryption aes-256

hash sha

group 2

lifetime 86400

crypto isakmp policy 40

authentication crack

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 50

authentication rsa-sig

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 60

authentication pre-share

encryption aes-192

hash sha

group 2

lifetime 86400

crypto isakmp policy 70

authentication crack

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 80

authentication rsa-sig

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 90

authentication pre-share

encryption aes

hash sha

group 2

lifetime 86400

crypto isakmp policy 100

authentication crack

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 110

authentication rsa-sig

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 120

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

crypto isakmp policy 130

authentication crack

encryption des

hash sha

group 2

lifetime 86400

crypto isakmp policy 140

authentication rsa-sig

encryption des

hash sha

group 2

lifetime 86400

crypto isakmp policy 150

authentication pre-share

encryption des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh timeout 5

console timeout 0

management-access inside

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd enable management

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

group-policy GroupPolicy1 internal

group-policy GroupPolicy1 attributes

vpn-tunnel-protocol IPSec

tunnel-group 81.137.231.247 type ipsec-l2l

tunnel-group 81.137.231.247 general-attributes

default-group-policy GroupPolicy1

tunnel-group 81.137.231.247 ipsec-attributes

pre-shared-key *****

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect rsh

  inspect rtsp

  inspect esmtp

  inspect sqlnet

  inspect skinny 

  inspect sunrpc

  inspect xdmcp

  inspect sip 

  inspect netbios

  inspect tftp

  inspect ip-options

  inspect icmp

!

service-policy global_policy global

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:fa8de377ab001d57f8cba8d9b76789c1

: end

asdm location Warehouse 255.255.255.0 inside

no asdm history enable

2 ACCEPTED SOLUTIONS

Accepted Solutions
New Member

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Dear Chris,

Please try to add these steps to you ASA :-

- change the security level of inside2 interface to 50 instead of 100.

- Add these ACL

access-list internal extended permit ip any any

access-list internal extended permit icmp any any

access-list external extended permit icmp any any

access-list external extended permit ip any any

access-list internal1 extended permit ip any any

access-list internal1 extended permit icmp any any

access-group external in interface inside

access-group internal1 in interface DMZ

access-group internal in interface outside

access-group external in interface inside
access-group internal1 in interface DMZ
access-group internal in interface outside

Also change the static NAT to (static (inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.0.0)

Let me know if this work,

Regards,

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Hi Christian,

You have named that DMZ interface as inside1. So please apply like the below and check.

access-group internal1 in interface inside1 and check. It should work.

Please do rate if the given information helps you.

By

Karthik

4 REPLIES
New Member

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Dear Chris,

Please try to add these steps to you ASA :-

- change the security level of inside2 interface to 50 instead of 100.

- Add these ACL

access-list internal extended permit ip any any

access-list internal extended permit icmp any any

access-list external extended permit icmp any any

access-list external extended permit ip any any

access-list internal1 extended permit ip any any

access-list internal1 extended permit icmp any any

access-group external in interface inside

access-group internal1 in interface DMZ

access-group internal in interface outside

access-group external in interface inside
access-group internal1 in interface DMZ
access-group internal in interface outside

Also change the static NAT to (static (inside,DMZ) 192.168.0.0 192.168.0.0 netmask 255.255.0.0)

Let me know if this work,

Regards,

New Member

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Hi,

Thankyou very much.

The pings are now working one way (from inside to inside 2) but not the other way

DMZ interface wasnt recognised on the line:

access-group internal1 in interface DMZ

cheers

Christian

Enable traffic between 2 internal interfaces (cisco ASA 5510)

Hi Christian,

You have named that DMZ interface as inside1. So please apply like the below and check.

access-group internal1 in interface inside1 and check. It should work.

Please do rate if the given information helps you.

By

Karthik

New Member

Enable traffic between 2 internal interfaces (cisco ASA 5510)

I fiddled about with what you sent me

I adjusted the line to:

static (inside,inside2) 192.168.0.0 192.168.0.0 netmask 255.255.0.0)

From

static (inside,inside2) 192.168.33.0 192.168.32.0 netmask 255.255.255.0

So yes that helped alot thanks

11438
Views
0
Helpful
4
Replies
CreatePlease to create content