Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Attention: The Cisco Support Community site will be in read only mode on Dec14, 2017 from 12:01am PST to 11:30am for standard maintenance. Sorry for the inconvenience.

New Member

Issue with Config

Hello Experts,
I'm in process of configuring the firewall and switch model 2948G running on CAT OS where I configured sub interfaces and assigned the IP addresses and VLAN on firewall interface and the firewall port is connected with switch port which is a trunk port allowing all the VLAN traffic. Now when I connect any machine with any switch port member of VLAN 1 then I won't able to ping the gateway even I assigned the IP address from the same network of VLAN 1 to switch sc0 port that I can ping so most probably it looks the communication problem in between switch and firewall. The firewall model is asa 5510 with security plus license. Please assist in this and share your thoughts what could be a problem and how to resolve it. I'm not expert in CAT OS and having some problems to troubleshoot the issue.

Thanks

Sent from Cisco Technical Support iPhone App

8 REPLIES
New Member

Issue with Config

Hello Ray,

Ping is not enabled by default on Cisco ASA. Can you try to ping the machine IP from ASA instead.

If that is successful, it means there is no communication issue between the firewall & switch. You would then need to allow ping on your ASA.

Let us know the output.

Thanks.

New Member

Re: Issue with Config

Yes I did from both ends but it didn't work.

Sent from Cisco Technical Support iPhone App

New Member

Issue with Config

Hello Ray,

Try to create SVI for VLAN 1 on your switch as well. Then try to ping it from your machine & Firewall. This will confirm if the issue is between the machine & switch or between switch & firewall.

Once done, please share the port configuration for connection from switch to firewall. Also give config for firewall port connected to switch as well.

Thanks.

New Member

Re: Issue with Config

All ports other than trunk port are by default are a part of VLAN 1 on switch so no need to configure it separately

I can ping the assigned IP of switch sc0 from connected machine so the problem is only in between firewall and switch communication where I need your assist.
Thanks

Sent from Cisco Technical Support iPhone App

Issue with Config

Please share the configuration done on firewall..

New Member

Issue with Config

Please see the firewall config below which access I have it right now. the switch config I will send it later once my colleague reach at DC as the switch can be accessible via console:

:

ASA Version 8.2(5)

!

names

!

interface Ethernet0/0

nameif outside

security-level 0

ip address x.x.x.x 255.255.255.224

!

interface Ethernet0/1

no nameif

no security-level

no ip address

!

interface Ethernet0/2

no nameif

no security-level

no ip address

!

interface Ethernet0/3

<--- More --->

shutdown

no nameif

no security-level

no ip address

!

interface Management0/0

shutdown

no nameif

no security-level

no ip address

!

interface Redundant1

member-interface Ethernet0/1

member-interface Ethernet0/2

no nameif

no security-level

no ip address

!

interface Redundant1.1

description Management

vlan 1

nameif inside

security-level 100

ip address 10.1.10.1 255.255.255.0

<--- More --->

!

interface Redundant1.2

description DMZ Servers

vlan 2

nameif DMZ

security-level 50

ip address 10.1.12.1 255.255.255.0

!

interface Redundant1.3

description Infrastructure Servers

vlan 3

nameif Infra

security-level 60

ip address 10.1.14.1 255.255.255.0

!

interface Redundant1.4

description Database Servers

vlan 4

nameif database

security-level 90

ip address 10.1.16.1 255.255.255.0

!

boot system disk0:/asa825-k8.bin

ftp mode passive

<--- More --->

access-list dc_splitTunnelAcl standard permit 10.1.10.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.16.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.12.0 255.255.255.0

access-list dc_splitTunnelAcl standard permit 10.1.14.0 255.255.255.0

access-list inside_nat0_outbound_1 extended permit ip 10.1.10.0 255.255.255.0 192.168.11.0 255.255.255.0

pager lines 24

logging enable

logging asdm informational

mtu outside 1500

mtu inside 1500

mtu DMZ 1500

mtu Infra 1500

mtu database 1500

ip local pool DC_Pool 192.168.11.100-192.168.11.254 mask 255.255.255.0

ip verify reverse-path interface outside

ip verify reverse-path interface inside

ip verify reverse-path interface DMZ

ip verify reverse-path interface Infra

ip verify reverse-path interface database

no failover

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

<--- More --->

nat (inside) 0 access-list inside_nat0_outbound_1

route outside 0.0.0.0 0.0.0.0 216.182.216.129 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

aaa authentication http console LOCAL

http server enable

http 0.0.0.0 0.0.0.0 outside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac

crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac

crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac

crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac

crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac

crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac

crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac

<--- More --->

crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac

crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac

crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs

crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5

crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP

crypto map outside_map interface outside

crypto ca trustpoint _SmartCallHome_ServerCA

crl configure

crypto isakmp enable outside

crypto isakmp policy 10

authentication pre-share

encryption 3des

hash sha

group 2

lifetime 86400

telnet timeout 5

ssh 0.0.0.0 0.0.0.0 outside

ssh timeout 5

console timeout 0

management-access inside

threat-detection basic-threat

<--- More --->

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

webvpn

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map type inspect dns preset_dns_map

parameters

<--- More --->

  message-length maximum client auto

  message-length maximum 512

policy-map global_policy

class inspection_default

  inspect dns preset_dns_map

  inspect ftp

  inspect h323 h225

  inspect h323 ras

  inspect ip-options

  inspect netbios

  inspect rsh

  inspect rtsp

  inspect skinny 

  inspect esmtp

  inspect sqlnet

  inspect sunrpc

  inspect tftp

  inspect sip 

  inspect xdmcp

!

service-policy global_policy global

prompt hostname context

call-home reporting anonymous

call-home

<--- More --->

profile CiscoTAC-1

  no active

  destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService

  destination address email callhome@cisco.com

  destination transport-method http

  subscribe-to-alert-group diagnostic

  subscribe-to-alert-group environment

  subscribe-to-alert-group inventory periodic monthly

  subscribe-to-alert-group configuration periodic monthly

  subscribe-to-alert-group telemetry periodic daily

Cryptochecksum:ff8c256c0925e4125da7163b1d08a5ba

:

Logoff

New Member

Re: Issue with Config


Can somebody please assist in this?

Thanks

Sent from Cisco Technical Support iPhone App

New Member

Re: Issue with Config

Please see the switch config as well
!
#time: Fri Jul 5 2013, 12:54:28
!
#version 8.4(11)GLX
!
!

!
#dot1x
set feature dot1x-radius-keepalive disable
!
#system
set system name Switch-Primary
set system location
set system contact
!
#frame distribution method
set port channel all distribution mac both
!
#ip
set interface sc0 1 10.1.10.2/255.255.255.0 10.1.10.255

set interface sl0 down
set interface me1 down
set ip route 0.0.0.0/0.0.0.0 10.1.10.1
set ip alias default 0.0.0.0
!
#set boot command
set boot config-register 0xf
set boot system flash bootflash:cat4000-k9.8-4-11-GLX.bin
!
#multicast filter
set igmp filter disable
!
#module 1 : 0-port Switching Supervisor
!
#module 2 : 50-port 10/100/1000 Ethernet
set trunk 2/12 on dot1q 1-1005,1025-4094
end
Switch-Primary-> (enable)

202
Views
0
Helpful
8
Replies
CreatePlease to create content