07-03-2013 09:44 PM - edited 03-07-2019 02:13 PM
Hello Experts,
I'm in process of configuring the firewall and switch model 2948G running on CAT OS where I configured sub interfaces and assigned the IP addresses and VLAN on firewall interface and the firewall port is connected with switch port which is a trunk port allowing all the VLAN traffic. Now when I connect any machine with any switch port member of VLAN 1 then I won't able to ping the gateway even I assigned the IP address from the same network of VLAN 1 to switch sc0 port that I can ping so most probably it looks the communication problem in between switch and firewall. The firewall model is asa 5510 with security plus license. Please assist in this and share your thoughts what could be a problem and how to resolve it. I'm not expert in CAT OS and having some problems to troubleshoot the issue.
Thanks
Sent from Cisco Technical Support iPhone App
07-03-2013 09:54 PM
Hello Ray,
Ping is not enabled by default on Cisco ASA. Can you try to ping the machine IP from ASA instead.
If that is successful, it means there is no communication issue between the firewall & switch. You would then need to allow ping on your ASA.
Let us know the output.
Thanks.
07-03-2013 09:59 PM
Yes I did from both ends but it didn't work.
Sent from Cisco Technical Support iPhone App
07-03-2013 10:12 PM
Hello Ray,
Try to create SVI for VLAN 1 on your switch as well. Then try to ping it from your machine & Firewall. This will confirm if the issue is between the machine & switch or between switch & firewall.
Once done, please share the port configuration for connection from switch to firewall. Also give config for firewall port connected to switch as well.
Thanks.
07-03-2013 10:16 PM
All ports other than trunk port are by default are a part of VLAN 1 on switch so no need to configure it separately
I can ping the assigned IP of switch sc0 from connected machine so the problem is only in between firewall and switch communication where I need your assist.
Thanks
Sent from Cisco Technical Support iPhone App
07-03-2013 10:54 PM
Please share the configuration done on firewall..
07-03-2013 11:29 PM
Please see the firewall config below which access I have it right now. the switch config I will send it later once my colleague reach at DC as the switch can be accessible via console:
:
ASA Version 8.2(5)
!
names
!
interface Ethernet0/0
nameif outside
security-level 0
ip address x.x.x.x 255.255.255.224
!
interface Ethernet0/1
no nameif
no security-level
no ip address
!
interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Ethernet0/3
<--- More --->
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
no nameif
no security-level
no ip address
!
interface Redundant1
member-interface Ethernet0/1
member-interface Ethernet0/2
no nameif
no security-level
no ip address
!
interface Redundant1.1
description Management
vlan 1
nameif inside
security-level 100
ip address 10.1.10.1 255.255.255.0
<--- More --->
!
interface Redundant1.2
description DMZ Servers
vlan 2
nameif DMZ
security-level 50
ip address 10.1.12.1 255.255.255.0
!
interface Redundant1.3
description Infrastructure Servers
vlan 3
nameif Infra
security-level 60
ip address 10.1.14.1 255.255.255.0
!
interface Redundant1.4
description Database Servers
vlan 4
nameif database
security-level 90
ip address 10.1.16.1 255.255.255.0
!
boot system disk0:/asa825-k8.bin
ftp mode passive
<--- More --->
access-list dc_splitTunnelAcl standard permit 10.1.10.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.16.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.12.0 255.255.255.0
access-list dc_splitTunnelAcl standard permit 10.1.14.0 255.255.255.0
access-list inside_nat0_outbound_1 extended permit ip 10.1.10.0 255.255.255.0 192.168.11.0 255.255.255.0
pager lines 24
logging enable
logging asdm informational
mtu outside 1500
mtu inside 1500
mtu DMZ 1500
mtu Infra 1500
mtu database 1500
ip local pool DC_Pool 192.168.11.100-192.168.11.254 mask 255.255.255.0
ip verify reverse-path interface outside
ip verify reverse-path interface inside
ip verify reverse-path interface DMZ
ip verify reverse-path interface Infra
ip verify reverse-path interface database
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
<--- More --->
nat (inside) 0 access-list inside_nat0_outbound_1
route outside 0.0.0.0 0.0.0.0 216.182.216.129 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
http server enable
http 0.0.0.0 0.0.0.0 outside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
<--- More --->
crypto ipsec transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map outside_map interface outside
crypto ca trustpoint _SmartCallHome_ServerCA
crl configure
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 5
console timeout 0
management-access inside
threat-detection basic-threat
<--- More --->
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
<--- More --->
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect ip-options
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
call-home reporting anonymous
call-home
<--- More --->
profile CiscoTAC-1
no active
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:ff8c256c0925e4125da7163b1d08a5ba
:
Logoff
07-04-2013 05:18 AM
Can somebody please assist in this?
Thanks
Sent from Cisco Technical Support iPhone App
07-05-2013 10:00 AM
Please see the switch config as well
!
#time: Fri Jul 5 2013, 12:54:28
!
#version 8.4(11)GLX
!
!
!
#dot1x
set feature dot1x-radius-keepalive disable
!
#system
set system name Switch-Primary
set system location
set system contact
!
#frame distribution method
set port channel all distribution mac both
!
#ip
set interface sc0 1 10.1.10.2/255.255.255.0 10.1.10.255
set interface sl0 down
set interface me1 down
set ip route 0.0.0.0/0.0.0.0 10.1.10.1
set ip alias default 0.0.0.0
!
#set boot command
set boot config-register 0xf
set boot system flash bootflash:cat4000-k9.8-4-11-GLX.bin
!
#multicast filter
set igmp filter disable
!
#module 1 : 0-port Switching Supervisor
!
#module 2 : 50-port 10/100/1000 Ethernet
set trunk 2/12 on dot1q 1-1005,1025-4094
end
Switch-Primary-> (enable)
Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: