I've set up a new VLAN (VLAN 11) to service subnet 10.0.11.0\24. It's primarily for wired PCs. I have DHCP working. I can browse all of my network, file shares, ping interfaces etc. I can't get my new VLAN devices out onto the Internet, or communicating with 192.168.2.0/24 which is connected site-to-site VPN. Where have I gone wrong?
Note: I do all my firewall config through ASDM. I find CLI on the ASA confusing.
Hardware Used:
- Firewall – Cisco ASA 5510
- Core Switch – Dell Force10 50s Stacked
- DHCP – Windows Server 2008R2 (VM)
Switch Config (Relevant Parts):
interface GigabitEthernet 1/1
description Uplink to Cisco ASA5510
no ip address
portmode hybrid
switchport
no shutdown
sh vlan
NUM Status Description Q Ports
1 Active U Gi 0/1-23,25-43
U Gi 1/1-44
10 Active T Gi 0/1,44
T Gi 1/1
11 Active T Gi 0/1
U Gi 0/24
T Gi 1/1
sh ip int br
Vlan 1 192.168.1.230 YES Manual up up
Vlan 10 10.0.10.251 YES Manual up up
Vlan 11 10.0.11.251 YES Manual up up
sh ip route
Destination Gateway Dist/Metric Last Change
----------- ------- ----------- -----------
*S 0.0.0.0/0 via 192.168.1.250, Vl 1 1/0 81w5d
C 10.0.10.0/24 Direct, Vl 10 0/0 4d6h
C 10.0.11.0/24 Direct, Vl 11 0/0 2d23h
C 192.168.1.0/24 Direct, Vl 1 0/0 81w5d
Firewall Config:
sh run
: Saved
:
: Serial Number: *****
: Hardware: ASA5510, 1024 MB RAM, CPU Pentium 4 Celeron 1600 MHz
:
ASA Version 9.1(6)
!
hostname LDHQFW
enable password 6OKb.d/KJtTCYuU9 encrypted
xlate per-session deny tcp any4 any4
xlate per-session deny tcp any4 any6
xlate per-session deny tcp any6 any4
xlate per-session deny tcp any6 any6
xlate per-session deny udp any4 any4 eq domain
xlate per-session deny udp any4 any6 eq domain
xlate per-session deny udp any6 any4 eq domain
xlate per-session deny udp any6 any6 eq domain
passwd 2KFQnbNIdI.2KYOU encrypted
names
ip local pool VPN 10.1.11.1-10.1.11.254 mask 255.255.255.0
ip local pool AC-10 10.0.0.1-10.0.0.50 mask 255.255.255.0
ip local pool 172.16.10.0 172.16.10.1-172.16.10.200 mask 255.255.255.0
!
interface Ethernet0/0
nameif Outside
security-level 0
ip address x.x.x.185 255.255.255.248
!
interface Ethernet0/1
nameif Inside
security-level 100
ip address 192.168.1.171 255.255.255.0
!
interface Ethernet0/1.10
description HQ_Servers
vlan 10
nameif VLAN_10
security-level 100
ip address 10.0.10.252 255.255.255.0
!
interface Ethernet0/1.11
description HQ_PCs
vlan 11
nameif VLAN_11
security-level 100
ip address 10.0.11.252 255.255.255.0
!
interface Ethernet0/2
shutdown
no nameif
no security-level
no ip address
!
interface Ethernet0/3
shutdown
no nameif
no security-level
no ip address
!
interface Management0/0
shutdown
nameif Management
security-level 100
no ip address
!
boot system disk0:/asa916-k8.bin
boot system disk0:/asa915-k8.bin
boot system disk0:/asa913-k8.bin
boot system disk0:/asa912-k8.bin
ftp mode passive
clock timezone EST -5
clock summer-time EDT recurring
dns domain-lookup Inside
dns server-group DefaultDNS
name-server 192.168.1.221
name-server 192.168.1.225
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
object network 192.168.0.0_24
subnet 192.168.0.0 255.255.255.0
object network 192.168.1.0_24
subnet 192.168.1.0 255.255.255.0
object network 192.168.2.0_24
subnet 192.168.2.0 255.255.255.0
description MFG
object network NETWORK_OBJ_192.168.1.0_24
subnet 192.168.1.0 255.255.255.0
object network 192.168.1.96_27
subnet 192.168.1.96 255.255.255.224
object network myvpn
subnet 10.1.11.0 255.255.255.0
object network NETWORK_OBJ_10.1.11.0_24
subnet 10.1.11.0 255.255.255.0
object network insidenat
subnet 10.250.250.0 255.255.255.0
object network ComcastGateway
host x.x.x.x
object network 192.168.6.0_24
subnet 192.168.6.0 255.255.255.0
object network LDHQFS_FTPServer
host 192.168.1.227
object network FTPServer_ext
host x.x.x.186
object service FTP2
service tcp source range 1 65535 destination eq 35262
object network LDHQWS_Internal
host 192.168.1.226
object network LDHQEC_EXT
host x.x.x.187
object service RDP
service tcp source range 1 65535 destination eq 3389
object network RouterVLAN2
host 192.168.0.2
object network MFG_Inside-Network
subnet 192.168.2.0 255.255.255.0
object network 192.168.50.0_24
subnet 192.168.50.0 255.255.255.0
object network LDHQSQL
host 192.168.1.222
object network NETWORK_OBJ_10.0.0.0_26
subnet 10.0.0.0 255.255.255.192
object service ftp_ssl_tls
service tcp source range 1 65535 destination eq 990
description implicit ftp
object service ftp_passive
service tcp source range 1 65535 destination range 51200 51300
object network LDHQEC_INT
host 192.168.1.228
object network LDHQUB_INT
host 192.168.1.218
description Ubuntu Server Interior IP Address
object network LDHQUB_EXT
host x.x.x.188
description External Ip Address
object network HQ_PCs
subnet 10.0.11.0 255.255.255.0
description HQ_PCs
object network HQ_Printers
subnet 10.0.12.0 255.255.255.0
description HQ_Printers
object network HQ_Servers
subnet 10.0.10.0 255.255.255.0
description HQ_Servers
object network HQ_Wireless
subnet 10.0.13.0 255.255.255.0
description HQ_Wireless
object network VPN_IPs_172
subnet 172.16.10.0 255.255.255.0
description VPN IP Address Pool 172.16.10.0\24
object network VPN_Public_IP
host x.x.x.185
description VPN Public Address
object network CoreSwitch_VLAN11
host 10.0.11.251
object network Router_VLAN_11
host 10.0.11.250
object-group network LDHQ
description All Headquarters networks
network-object object 192.168.0.0_24
network-object object 192.168.1.0_24
network-object object 192.168.2.0_24
network-object object HQ_PCs
network-object object HQ_Printers
network-object object HQ_Servers
network-object object HQ_Wireless
object-group service FTPPassive tcp
port-object range 51200 51300
port-object eq ftp
object-group service DM_INLINE_TCP_1 tcp
port-object eq www
port-object eq https
object-group service FTP_Ports tcp
port-object range 51200 51300
port-object eq 990
port-object eq ftp
port-object eq ftp-data
object-group network d90_home
network-object 10.10.10.0 255.255.255.0
network-object 10.10.5.0 255.255.255.0
access-list Outside_access_in extended permit tcp any object LDHQFS_FTPServer object-group FTP_Ports
access-list Outside_access_in extended permit ip object-group LDHQ any4
access-list Outside_access_in extended permit icmp any4 any4
access-list Outside_access_in extended permit tcp any object LDHQEC_INT object-group DM_INLINE_TCP_1
access-list Outside_access_in extended permit tcp any object LDHQUB_INT eq www
access-list Inside_access_in extended permit ip object-group LDHQ any4
access-list HQ_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list LDHQ_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list LD_10_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list LD_10_splitTunnelAcl standard permit 10.1.11.0 255.255.255.0
access-list crypto_allowmyvpnaccess extended permit ip object myvpn object insidenat
access-list LD_6_splitTunnelAcl standard permit 192.168.1.0 255.255.255.0
access-list LD_6_splitTunnelAcl standard permit 192.168.2.0 255.255.255.0
access-list Outside_cryptomap extended permit ip object 192.168.1.0_24 object 192.168.2.0_24
access-list Outside_cryptomap extended permit ip 10.0.0.0 255.255.255.0 object 192.168.2.0_24
access-list LDCorp_MFG_Networks standard permit 192.168.1.0 255.255.255.0
access-list LDCorp_MFG_Networks standard permit 192.168.2.0 255.255.255.0
pager lines 24
logging enable
logging timestamp
logging emblem
logging trap debugging
logging history debugging
logging asdm informational
logging facility 16
logging host Inside 192.168.1.226 format emblem
logging debug-trace
mtu Outside 1500
mtu Inside 1500
mtu VLAN_10 1500
mtu VLAN_11 1500
mtu Management 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-743.bin
no asdm history enable
arp timeout 14400
no arp permit-nonconnected
nat (Inside,Inside) source dynamic any interface destination static LDHQUB_EXT LDHQUB_INT description U-Turn for Feedback.mydomain.com
nat (Inside,Inside) source dynamic any interface destination static LDHQEC_EXT LDHQEC_INT description U-Turn for enterprise\parts.mydomain.com
nat (Inside,Outside) source static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 destination static NETWORK_OBJ_192.168.1.0_24 NETWORK_OBJ_192.168.1.0_24 inactive
nat (Inside,Outside) source static LDHQ LDHQ destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive
nat (Outside,Inside) source static myvpn myvpn destination static insidenat insidenat inactive
nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.6.0_24 192.168.6.0_24 no-proxy-arp route-lookup inactive
nat (Inside,Outside) source static 192.168.2.0_24 192.168.2.0_24 destination static 192.168.1.0_24 192.168.1.0_24 no-proxy-arp route-lookup
nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.2.0_24 192.168.2.0_24 no-proxy-arp route-lookup
nat (Outside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive
nat (Inside,Outside) source static 192.168.1.0_24 192.168.1.0_24 destination static 192.168.1.96_27 192.168.1.96_27 no-proxy-arp route-lookup inactive
nat (Inside,Outside) source static any any destination static 192.168.50.0_24 192.168.50.0_24 no-proxy-arp route-lookup inactive
nat (Inside,Outside) source static any any destination static VPN_IPs_172 VPN_IPs_172 no-proxy-arp route-lookup
nat (Inside,Outside) source static LDHQ LDHQ destination static VPN_IPs_172 VPN_IPs_172 no-proxy-arp route-lookup
nat (Outside,Inside) source static any any destination static LDHQEC_EXT LDHQEC_INT
nat (any,Inside) source static any any destination static LDHQUB_EXT LDHQUB_INT
nat (Inside,Outside) source static LDHQ LDHQ destination static d90_home d90_home no-proxy-arp route-lookup
!
object network LDHQFS_FTPServer
nat (Inside,Outside) static FTPServer_ext
!
nat (Inside,Outside) after-auto source dynamic any interface
access-group Outside_access_in in interface Outside
access-group Inside_access_in in interface Management
route Outside 0.0.0.0 0.0.0.0 x.x.x.190 1
timeout xlate 3:00:00
timeout pat-xlate 0:00:30
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa-server AD protocol ldap
aaa-server AD (Inside) host 192.168.1.225
server-port 389
ldap-base-dn DC=LDI_NETWORK,DC=COM
ldap-scope subtree
ldap-login-password *****
ldap-login-dn CN=CiscoVPN,CN=Managed Service Accounts,DC=LDI_NETWORK,DC=COM
server-type microsoft
user-identity default-domain LOCAL
aaa authentication ssh console LOCAL
aaa authentication http console LOCAL
aaa local authentication attempts max-fail 5
http server enable
http 192.168.1.0 255.255.255.0 Management
http 192.168.1.0 255.255.255.0 Inside
http 192.168.0.0 255.255.255.0 Inside
http 10.0.10.0 255.255.255.0 Inside
snmp-server host Inside 192.168.1.226 community ***** udp-port 514
snmp-server host-group Inside NETWORK_OBJ_192.168.1.0_24 poll community *****
snmp-server location LD HQ
snmp-server contact Nicholas Dininno
snmp-server community *****
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA-TRANS mode transport
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5-TRANS mode transport
crypto ipsec ikev2 ipsec-proposal AES256
protocol esp encryption aes-256
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES192
protocol esp encryption aes-192
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal AES
protocol esp encryption aes
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal 3DES
protocol esp encryption 3des
protocol esp integrity sha-1 md5
crypto ipsec ikev2 ipsec-proposal DES
protocol esp encryption des
protocol esp integrity sha-1 md5
crypto ipsec security-association pmtu-aging infinite
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set pfs group1
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev1 transform-set ESP-AES-128-SHA ESP-AES-128-MD5 ESP-AES-192-SHA ESP-AES-192-MD5 ESP-AES-256-SHA ESP-AES-256-MD5 ESP-3DES-SHA ESP-3DES-MD5 ESP-DES-SHA ESP-DES-MD5
crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set ikev2 ipsec-proposal AES256 AES192 AES 3DES DES
crypto map Outside_map 10 match address Outside_cryptomap
crypto map Outside_map 10 set pfs
crypto map Outside_map 10 set peer x.x.x.99
crypto map Outside_map 10 set ikev1 transform-set ESP-AES-256-SHA
crypto map Outside_map 10 set ikev2 ipsec-proposal DES 3DES AES AES192 AES256
crypto map Outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
crypto map Outside_map interface Outside
crypto ca trustpoint _SmartCallHome_ServerCA
no validation-usage
crl configure
crypto ca trustpoint ASDM_TrustPoint0
enrollment self
subject-name CN=LDHQFW
keypair LDAnyConnect
crl configure
crypto ca trustpoint ASDM_TrustPoint1
enrollment terminal
subject-name CN=work.mydomain.com,O=My Company Inc,C=US
keypair VPN_1_8_2016_Req
crl configure
crypto ca trustpoint ASDM_TrustPoint3
enrollment self
subject-name CN=192.168.1.171
crl configure
crypto ca trustpool policy
crypto ca certificate chain _SmartCallHome_ServerCA
crypto ikev2 policy 1
encryption aes-256
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 10
encryption aes-192
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 20
encryption aes
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 30
encryption 3des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 policy 40
encryption des
integrity sha
group 5 2
prf sha
lifetime seconds 86400
crypto ikev2 enable Outside client-services port 443
crypto ikev2 remote-access trustpoint ASDM_TrustPoint1
crypto ikev1 enable Outside
crypto ikev1 policy 10
authentication crack
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 20
authentication rsa-sig
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 30
authentication pre-share
encryption aes-256
hash sha
group 2
lifetime 86400
crypto ikev1 policy 40
authentication crack
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 50
authentication rsa-sig
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 60
authentication pre-share
encryption aes-192
hash sha
group 2
lifetime 86400
crypto ikev1 policy 70
authentication crack
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 80
authentication rsa-sig
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 90
authentication pre-share
encryption aes
hash sha
group 2
lifetime 86400
crypto ikev1 policy 100
authentication crack
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 110
authentication rsa-sig
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 120
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 130
authentication crack
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 140
authentication rsa-sig
encryption des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 150
authentication pre-share
encryption des
hash sha
group 2
lifetime 86400
telnet 192.168.1.0 255.255.255.0 Inside
telnet 192.168.1.0 255.255.255.0 Management
telnet timeout 5
ssh stricthostkeycheck
ssh 0.0.0.0 0.0.0.0 Outside
ssh 192.168.1.0 255.255.255.0 Inside
ssh timeout 5
ssh key-exchange group dh-group1-sha1
console timeout 0
management-access Inside
vpn-addr-assign local reuse-delay 10
dhcpd auto_config Inside
!
threat-detection basic-threat
threat-detection statistics host
threat-detection statistics port
threat-detection statistics protocol
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
ntp server 192.168.1.250 source Inside
ssl trust-point ASDM_TrustPoint1 Outside
ssl trust-point ASDM_TrustPoint3 Inside
webvpn
enable Outside
anyconnect-essentials
anyconnect image disk0:/anyconnect-win-3.1.05170-k9.pkg 1
anyconnect image disk0:/anyconnect-macosx-i386-3.1.04074-k9.pkg 2
anyconnect profiles AC_LDVPN_client_profile disk0:/AC_LDVPN_client_profile.xml
anyconnect profiles AnyConnect_client_profile disk0:/AnyConnect_client_profile.xml
anyconnect enable
tunnel-group-list enable
group-policy DfltGrpPolicy attributes
vpn-tunnel-protocol ikev1 ikev2 ssl-clientless
group-policy GroupPolicy_AC_LDVPN internal
group-policy GroupPolicy_AC_LDVPN attributes
wins-server none
dns-server value 192.168.1.225 192.168.1.221
vpn-tunnel-protocol ikev1 ikev2 ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value LDCorp_MFG_Networks
default-domain none
webvpn
anyconnect profiles value AC_LDVPN_client_profile type user
group-policy GroupPolicy_x.x.x.99 internal
group-policy GroupPolicy_x.x.x.99 attributes
vpn-tunnel-protocol ikev1 ikev2
group-policy HQ internal
group-policy HQ attributes
dns-server value 192.168.1.220 192.168.1.221
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value LD_6_splitTunnelAcl
username ******* password ******** encrypted privilege 15
tunnel-group HQ type remote-access
tunnel-group HQ general-attributes
address-pool 172.16.10.0
authentication-server-group AD
default-group-policy HQ
tunnel-group HQ ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group x.x.x.99 type ipsec-l2l
tunnel-group x.x.x.99 general-attributes
default-group-policy GroupPolicy_x.x.x.99
tunnel-group x.x.x.99 ipsec-attributes
ikev1 pre-shared-key *****
ikev2 remote-authentication pre-shared-key *****
ikev2 local-authentication pre-shared-key *****
tunnel-group AC_LDVPN type remote-access
tunnel-group AC_LDVPN general-attributes
address-pool 172.16.10.0
authentication-server-group AD
default-group-policy GroupPolicy_AC_LDVPN
tunnel-group AC_LDVPN webvpn-attributes
group-alias AC_LDVPN enable
!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum client auto
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect rsh
inspect rtsp
inspect esmtp
inspect sqlnet
inspect skinny
inspect sunrpc
inspect xdmcp
inspect sip
inspect netbios
inspect tftp
inspect ip-options
class class-default
user-statistics accounting
!
service-policy global_policy global
prompt hostname context
service call-home
call-home reporting anonymous
call-home
contact-email-addr me@mydomain.com
contact-name Nicholas
phone-number 732-474-8723
profile CiscoTAC-1
destination address http https://tools.cisco.com/its/service/oddce/services/DDCEService
destination address email callhome@cisco.com
destination transport-method http
subscribe-to-alert-group diagnostic
subscribe-to-alert-group environment
subscribe-to-alert-group inventory periodic monthly
subscribe-to-alert-group configuration periodic monthly
subscribe-to-alert-group telemetry periodic daily
Cryptochecksum:xxxxx
: end
LDHQFW#
Best Answer
Routers route between networks. You don't route from one network to the same network: This is probably your problem:
All your other routes are to
192.168.1.171, a hop on a different network (the firewall inside interface):You can try this:
Edit:
I guess I don't understand the purpose of the Cisco 1921 router. You are routing the same networks on both the 1921 and the ASA. It looks like you are using the ASA as the DHCP server.
You could remove the 1921 and change DHCP to point the gateways to the ASA itself. Alternatively, you could move DHCP to the 1921 and remove the VLANs from the ASA. In either case, you only need the VLANs on one of the devices, and have the
192.168.1.0/24link between them (you don't need to use a/24because a/31or, more traditionally, a/30).Using static routing, as you have configured, doesn't scale, and, as you have discovered, causes you to manually make changes, which increases the possibility of problems or errors.
If you want both the router and the ASA, you can use OSPF to exchange routes. The ASA would the inject the default route into OSPF, and the 1921 would inject the VLAN routes into OSPF. Each device would automatically learn the routes from the other device through OSPF.
Based on what you have, I would just eliminate the Cisco 1921 router, and change the gateways provided by the ASA. You would need to make the VLAN interfaces on the ASA be inside interfaces.