Cisco :: Connecting Two VLANs Via An ASA 5505?
Mar 20, 2013
routing between VLANs on my ASA 5505. I am very technical system wise, but my knowledge of routing and switching is very shallow.
What I am trying to accomplish: Small lab environment with basic services split onto two seperate VLANs (such that DHCP would need a relay on the second VLAN to deliver leases). No external network connection as of right now (so no Internet).
My current configuration:
Cisco Catalyst 2960
As you can see below, the two VLANs I am trying to set up are vlan101 (10.100.100.1) and vlan102 (10.100.101.1)
Code:
View 8 Replies
ADVERTISEMENT
May 24, 2012
i am trying to get my ASA 5505 with 2 internal VLANs (voice and data) and external internet VLAN to run in router as a stick, and route between VLANS.
I cant get it working though:
[code]...
View 4 Replies
View Related
Nov 18, 2011
i have asa 5505 adaptive security plus. and i have only 3 vlans . outside , inside , DMZ restricted.so it's working fine but i want to connect to my inside another private network, or do i need to buy License.and how i can activate the license key.
View 4 Replies
View Related
Dec 5, 2012
I have an ASA 5505 and I have the three regular vlans, outside, inside and dmz. The best would be only have outside and inside and skip dmz, but without explenation there is not possible to have more then two clients in whats now dmz because of a mac filter on third party device.
So as security is concerned dmz and inside is equal, one to one and there should be full access between them. I ran the wizard and said that the only way traffic not should be possible to flow is from dmz to outside.
In the NAT rules the onle rule is
global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0
But traffic from one way or the other dmz to inside, og inside to dmz it says in log
3Dec 06 201215:38:39305006172.17.6.1053portmap translation creation failed for udp src inside:192.168.6.102/49358 dst dmz:172.17.6.10/53 From documentation I have an image with network drawing from documentation. What do I have to do allow traffic btween inside and dmz, both ways.
View 3 Replies
View Related
Sep 16, 2012
I have a 5505 with Base license running ASA software v8.4(2) that has been working happily for a while with an inside and an outside VLAN.
The outside has a single statically configured public IP, and I have a number of static NAT rules to expose a few internal servers as well as Dynamic-NAT for all devices on inside to gain access to the Internet... the main bits of the config are below:
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
[code]....
I now have a requirement to add a "dmz" VLAN for guests to have access to the Internet using a dedicated wireless AP, but not to any of the inside resources. As the ASA has a base license I have configured "no forward interface" to the inside vlan, which suits the purpose fine
interface Vlan12
description Used only for guests access to the Internet - no access to the corporate resources
no forward interface Vlan1
nameif guests
security-level 20
ip address 192.168.2.1 255.255.255.0
My problem is that when I try to add NATing from the dmz to the outside I get a:
ERROR: Address a.b.c.d overlaps with outside interface address.
ERROR: NAT Policy is not downloaded
with either:
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic interface
[code]....
Having had a look at the ASA Configuration guides, all the examples I can see with several "internal" VLAN's being NAT'ed use one external IP per VLAN - is this a feature/restriction of the ASA software? Are there any workarounds? Or is the overlap in the error message really about the current NATing to the inside VLAN which is done on the "any" 0.0.0.0 subnet - would the following then work:
object network obj_any
subnet 192.168.1.0 255.255.255.0
nat (inside,outside) dynamic a.b.c.d
object network guests_subnet
subnet 192.168.2.0 255.255.255.0
nat (guests,outside) dynamic a.b.c.d
View 5 Replies
View Related
Oct 2, 2012
so I look up ASA5505 licensing and for VLAN support see: 3 (no trunking support)/20 (with trunking support)*
I need 3 VLANs...inside, outside, and DMZ..but when it is creating the third (DMZ) it says I am only allowed to have 2 VLANs and can only create the third if its set to not forward traffic. ?
View 1 Replies
View Related
Apr 19, 2011
I have 2 ASA 5505 firewalls and 1 cisco 3560 switch.
One ASA 5505 firewall and cisco 3560 switch located at SITE-A. Another ASA 5505 firewall located at SITE-B.
Below is the my connectivity:
Site-A IPSec VPN Site-B
cisco 3560 <----------------------------> ASA 5505<------------------------------------------------------------------------------------> ASA 5505
I planned to create 5 vlans in my cisco 3560 switch. these 5 vlans needs to have internet and needs to access Site-B.
I will write on dafault route to firewall in my cisco 3560 switch. Is ASA 5505 supports this scenario??? If it is then how to configure ASA 5505 firewall.
View 4 Replies
View Related
Aug 20, 2012
I've got an ASA 5505 with the Security Plus license that I'm trying to configure.
So far I have setup NATing on two VLANs, one called 16jda (VLAN 16 - 10.16.2.0/24) and one called 16jdc (VLAN 11 - 10.105.11.0/24).
From each subnet I am able to connect to the internet, but I need these subnets to also be able to talk to each other.
I have each VLAN interface at security level 100 and enabled "same-security-traffic permit inter-interface", and I have setup static NAT mappings between the two subnets, but they still can't communicate.
When I try to ping there is no reply and the only log message is: 6 Aug 21 2012 09:00:54 302020 10.16.2.10 23336 10.105.11.6 0 Built inbound ICMP connection for faddr 10.16.2.10/23336 gaddr 10.105.11.6/0 laddr 10.105.11.6/0
View 11 Replies
View Related
May 30, 2011
I have ASA 5505 Firewall with security plus license, I configured two V LAN 1 and V LAN 5 as my inside V LAN for different sub net, i need to route the traffic between this two V LAN's through ASA. I configured
int vlan 1
nameif inside
Security level 100
Ip address 172.16.100.1 255.255.255.0
[Code] .........
The problem is i am not able to ping other sub net, for ex my PC is in V LAN 1 not able to ping 192.168.22.1 ... For troubleshoot i type debug icmp trace while pinging other subnet
ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=4608 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=4864 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=5120 len=32ICMP echo request from 192.168.22.2 to 172.16.100.101 ID=512 seq=5376 len=32
I turn off the firewall on my local machine.
View 10 Replies
View Related
Dec 19, 2012
I have two Catalyst 2960 Series (48 port) switches with the newest Cisco IOS installed. There is also a Cisco 2600 Series Router which I can't manage because it's ISP managed.
Now the problem is as follows. I'd like to create two VLANs, one in the IP range 192.168.0.xxx and the other in the 192.168.1.xxx. Now the router has a gateway IP address 192.168.1.1 .
Would it be possible to somehow connect these two VLANs with the router so that these 2 VLANs can't see each other but they can ofcourse both contact the router and exit on the internet?
View 3 Replies
View Related
Apr 14, 2013
I have 2 Vlans with seperate networks and want to create a route between one server in vlan 465 to another server in vlan 436 via port 80.Vlan 465 has a ASA 5505 inside that IP address 89.254.12.35 will be initiating the connection to address 10.200.1.213.
-Vlan 465: server address 10.200.1.213
-Vlan 436: server address 89.254.12.35
However for extended security I would like to restrict the firewall opening to an IP to IP opening.
View 7 Replies
View Related
May 18, 2013
I am buying ASA 5505 with security license. It says it can support 20 vlans does it support 20 vlans by allowing to create subinterfaces? As it has 8 physical ports only?
View 3 Replies
View Related
Mar 15, 2013
I have a ASA 5505 with the security plus license. I have 7 vlans, 2 are guest vlans for wireless and wired connections. I am allowing traffic from the guest vlans to any with the http & https protocols I have ACL's in place before the allow all rule that do not allowed traffic from the guest vlans to the other vlans. Is there any way to have all traffic from the guest vlans to always go to the outside interface for the http & https traffic in stead of trying to go to the other vlans first, I know I have the ACL's in place to prevent the traffic but if I would feel better if I had this in place as well.
View 5 Replies
View Related
Jan 4, 2012
ASA 5505 vlans routing & access-list?
View 4 Replies
View Related
May 25, 2011
I have an ASA 5505 with the security plus software and I'm trying to find out how to assign 2 public IPs to the outside interface and have each IP routed to a separate internal VLAN. For example, IP 1 = X.X.X.1 routed to 192.168.1.0 and IP 2 X.X.X.2 routed to 192.168.2.0. I was told this was possible and I've been trying to find configuration examples, but I can't seem to get anywhere and now I'm getting desperate because I'm scheduled to install it this weekend.
View 1 Replies
View Related
Dec 22, 2012
I have set up a scenario for a small business and have some questions about how to manage the access between the VLANs. Is there is a better / another way to do it. See the attached picture for the topology / info.
My question is:
My switches is set up with x numbers of VLANs and a routed port (no switch port) to the ASA for internet connectivity. How is the best (or only??) way to manage the access between the VLANs? Is it ACL's on the switch?
And by "managing access" I mean VLAN 50 (public WiFi) only have access to the internet, only management servers have access to management VLAN, Client VLAN only have RDP access to server VLAN and so on. Is there any way to do this in the ASA (or add another (gigabit) router to the topology)) or it the only way to have lots of ACL's on the switch itself? I have thought about "router on a stick", but then I imagine there will be a bottleneck between the switch and the ASA?
(Equipment is 2 x 3650G, ASA5505, AP1252 - see attached file).
View 3 Replies
View Related
Jun 1, 2012
WE have to deploy ASA5585 in between User vlans & server vlans. we have to find all the ports that needs to be opened on firewall. any tools to do same.
View 2 Replies
View Related
Jun 29, 2011
i have a small asa 5505 trying to connect to a asa 5510
cisco-26834# sh crypto isakmp sa
Active SA: 1 Rekey SA: 0 (A tunnel will report 1 Active and 1 Rekey SA during rekey)Total IKE SA: 1
1 IKE Peer: 216.**.**.146 Type : user Role : initiator Rekey : no State : AM_CTCP_WAIT_REPLY
here's the full debug for the 5505 :
cisco-26834# Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, IKE AM Initiator FSM error history (struct &0xc66a55b8) <state>, <event>: AM_DONE, EV_ERROR-->AM_CTCP_WAIT_REPLY, EV_CTCP_LINK_FAIL-->AM_CTCP_WAIT_REPLY, NullEvent-->AM_CTCP_INIT, EV_REQ_CTCP_LINK-->AM_START, EV_START_AM-->AM_START, EV_START_AM-->AM_START, EV_START_AM-->AM_START, EV_START_AM
Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, IKE SA AM:c045cc52 terminating: flags 0x01000021, refcnt 0, tuncnt 0
Jun 30 03:35:26 [IKEv1 DEBUG]: IP = 216.**.**.146, sending delete/delete with reason message
Jun 30 03:35:26 [IKEv1]: IP = 216.**.**.146, Error: Unable to remove IPSec/TCP entry
[code].....
what should i check on my 5510 ?
View 1 Replies
View Related
Jan 20, 2013
I am a network Engineer but had no experinece in Firewall, right now i am under a pressure to take care of a ASA 5505 were all the VPN and Inbound and out bound were configured, recently i had some changes done and re done the change, but unfortunately it removed some configuration which are ment for VPN, now i am facing a problem,
VPN connection establishes but unable to browse internet is my problem, i tried inheriting the Split tunneli, but i coudnt get through it it seems, i doing some thing in a wrong way, i here use mostly ASDM,
i ll paste the Configuration for investigation,
ASA Version 8.0(4)16
!
hostname yantraind
domain-name yantra.intra
[Code]......
View 2 Replies
View Related
Apr 12, 2011
I am unable to connect to the vpn I set up on my ASA 5505 using the Cisco VPN Client on a Windows machine. The log of the vpn client and the config of the ASA 5505 are below.
LOG CISCO VPN CLIENT
Cisco Systems VPN Client Version 5.0.06.0160
Copyright (C) 1998-2009 Cisco Systems, Inc. All Rights Reserved.
[Code]......
View 2 Replies
View Related
Sep 13, 2012
We currently have 2 different ASA 5505 connect to our ASA5510. We want to VPN connect the 2 5505's to each other while still mantaining connection to our 5520. I have attached pdf of what we have. What we want is to connect traffic between the two 5505's so that devices in either location can talk to each other while still mantainig connection to the 5510.
View 13 Replies
View Related
Nov 7, 2012
We recently changed locations and acquired a new circuit from our provider. They also connected our remote branch office to our main office through MPLS. Now, as I understand it, the branch office basically connects back to the main office through our providers network (MPLS). We have a new router at the branch office which has a gateway of 192.168.1.225. The clients in that office have IP's of 192.168.1.96 - 100, using the gateway of 192.168.1.225.
The main office network is 192.168.0.0 (Gateway of 192.168.0.1)
At this end (Main office), I also have a new Cisco 2900 provided by the ISP, with port 0/0 for the outside connection (connected to the 0 port on my ASA 5505). The ASA's port 1 obviously running into my network hub. The provider tells me that port 0/1 on the 2900 is or should be used to connect the branch office back to here and has an IP of 192.168.0.225, as that's how the provider provisioned it. So, I plug that into the ASA's Ethernet port 0/2. And I'm assuming they have a route setup either on the 2900 or the router in the branch office so that 192.168.1.225 can reach me here at 192.168.0.0.
There is already a static route setup on the ASA: (192.168.1.0 255.255.255.255 192.168.0.225 1). As soon as I plug in the cable, the IP phones at the branch office work, but they can't access the internet or any resources in the main office. My questions are:
1. Shouldn't I be able to just go straight from the 0/1 port on the Cisco 2900 to my hub. At first I was plugging right into the ASA, but I don't think I need to do that, why go from the branch office through my ASA to access resources and then back out the ASA for internet. If they're already coming from 192.168.1.225, through the MPLS network, then they should go right to my network and then back out the ASA.
2. They have to route through the ASA first, in which case, do I need to setup another VLAN for that branch network in conjunction with a static route? I can ping the router and hosts in the branch office through the ASA only!
Below is the running sanitized config:
Result of the command: "show running-config"
: Saved:ASA Version 8.2(2) !hostname ciscoasadomain-name audiology.orgenable password ulzaQiFnKVzDwUmW encryptedpasswd 2KFQnbNIdI.2KYOU encryptednames!interface Vlan1nameif insidesecurity-level 100ip address 192.168.0.1 255.255.255.0 ospf cost 10!interface Vlan2nameif outsidesecurity-level 0ip address 1.2.3.4 255.255.255.240 ospf cost 10!interface Ethernet0/0switchport access vlan 2!interface Ethernet0/1!interface Ethernet0/2!interface Ethernet0/3!interface Ethernet0/4!interface Ethernet0/5!interface Ethernet0/6!interface Ethernet0/7!boot system disk0:/asa822-k8.binftp mode passiveclock timezone EST -5clock summer-time EDT recurringdns server-group DefaultDNSdomain-name audiology.orgsame-security-traffic permit inter-interfacesame-security-traffic permit intra-interfaceaccess-list
[code]....
View 16 Replies
View Related
Sep 13, 2012
We currently have 2 different ASA 5505 connect to our ASA5510. We want to VPN connect the 2 5505's to each other while still mantaining connection to our 5520. I have attached pdf of what we have. What we want is to connect traffic between the two 5505's so that devices in either location can talk to each other while still mantainig connection to the 5510.
View 1 Replies
View Related
Apr 4, 2011
We are planning to purchase an ASA 5505 for a VPN solution for one of our offices. The office has 50-60 user at peak load who would be connecting over the S2S VPN to the datacenter.
From a hardware standpoint, can the ASA 5505 handle this load. The licence is for unlimitedf inside hosts but what is the actual limit on this platform?
View 1 Replies
View Related
Sep 24, 2011
I am using two firewalls to connect two different offices. Firewall 5510 is running ASDM 6.3 and 5505 is running ASDM 6.2, Problem is that even after connecting two sites, i am unable to ping remote network from either side. I am mentioned static route as tunneled.
View 1 Replies
View Related
Dec 29, 2012
I am having problems with a customer's ASA 5505 with Anyconnect 3.1 - it is generating captive portal false-alerts which are stopping users from connecting. This issue began when I upgraded from Anyconnect 2.4 to 3.1, and it appears like this: A user downloads and installs the Anyconnect client and is able to connect fine, to begin with. However, once they reboot their computer and try to reconnect, the VPN session will not come up and they receive the error message below."The service provider in your current location is restricting access to the internet. You need to log on with the service provider before you can establish a VPN session. You can try this by visiting any website with your browser."
Reading other posts, it seems this message appears when a captive portal is restricting internet access. It must be a false alert in this case as there is nothing of the sort here. Apparently, Anyconnect 3.1 can generate a false alert like so if the name of the firewall's SSL certificate doesn't match the CName listed on the Client Profile. I've set this up to match, to no avail. Although users can connect by reauthenticating through the SSL VPN login web page, I am stumped as to how to get rid of this captive portal error that pops up when they try to use the Anyconnect client.
View 4 Replies
View Related
Apr 1, 2012
I connect to my corporate network using Cisco AnyConnect Secure Mobility Client. Once connected I can no longer print to my LAN attached printer and other local resources. I use the Cisco/Lyncsys E4200 router on my LAN and can re-connect to the storage on the local LAN by setting up Port Forwarding of port 21 and MS Windows FTP folder sharing. However, I can't seem to connect to a Terminal Services client by forwarding port 3389. Is there a way to connect to the local LAN after logging into the VPN connection. I can connect to regular HTTP/HTTPS sites and most other type of connectiins, just not my own local resources.
View 3 Replies
View Related
Aug 29, 2012
I manage IP-PBX(VoIP) in my work place which is consists of switches and a router as shown below,My intend is to seprate between Vlan 1 and Vlan 40, 41.(no packet exchange between vlan 1 <-> vlan 40,41)the Vlan 1 has C class 1 and Vlan 40,41 has C class 40,41.
View 2 Replies
View Related
Jul 8, 2012
Site A will have the ip address of 192.168.1.x subnet mask 255.255.255.0 and will need to commmunicate with Site B (ip address 192.168.100.x subnet mask 255.255.255.0). Neither site needs internet access, so I don't have a default gateway. I have a cisco 891 with the ip address of 192.168.1.254. I don't have anything set up on the cisco right now (no running config). Is this possible to set up?
View 11 Replies
View Related
Jan 19, 2013
when we ping from pc in lan 1 to pc in lan 2, what protocols we walk through in request and in response??
View 14 Replies
View Related
Sep 14, 2011
I have a 3 building client currently on a single LAN/subnet/VLAN1. The client wants to install two public APs in their other buildings. I have selected the Cisco WAP4410n for a few reasons, Price, as budget is a factor for them, the 4410n can have up to 4 SSIDs, and can accommodate different VLANs, and it is PoE.
The public side is to have no access to the LAN, just the internet.According to the documents I have read on the 4410, I am to create two SSIDs, one not broadcasted (VLAN1) and one that is broadcasted and public (VLAN2) Both SSIDs would be Isolated from each other.
I assign the switch port attached to the AP to VLAN2, but cannot access the internet. I believe that the two VLANs need to be bridged in either a L3 switch or a router, is this correct? Is that the only way I will be able to get internet access in this situation?A while back someone posted a link to a Cisco workshop. It was set in a spaceship, and the student, me, had to get internet access to different parts of the ship by installing different APs and antennas. Also had to give the people and aliens on the ship different levels of access.
View 2 Replies
View Related
Oct 2, 2012
if I want to bridge between 2 VLANs ,can I use IRB like I would use in a router for bridging to ethernet interfaces for example?
Config example:
bridge irb
interface vlan 10
ip address 192.168.10.1 255.255.255.0
bridge-group 1
[code].....
View 10 Replies
View Related
Jun 12, 2011
I am trying to configure a UCS 520 and need to setup the VLAN for the phones. I tried to use the vlan command from the config prompt and also from the vlan database and each time I get the following message:
UC520(vlan)#apply
% not enough space on flash to store vlan database. trying squeeze...
% error squeezing flash - (Operation not supported on this file)
Error on database apply 40: NV storage failure
Here is what my nvram is showing:
UC520#dir nvram:
Directory of nvram:/
246 -rw- 6461 <no date> startup-config
247 ---- 1933 <no date> private-config
248 -rw- 6461 <no date> underlying-config
1 -rw- 577 <no date> IOS-Self-Sig#1.cer
2 -rw- 0 <no date> ifIndex-table
3 ---- 61 <no date> persistent-data
262144 bytes total (250626 bytes free)
View 4 Replies
View Related
