Cisco ASA 5510 to Dell PowerSwitch connectivity problems.

[aaron1923]

Hello, I am new to Cisco ASAs and Dell PowerConnects. Yet some how I find myself setting these up without much success. A friend helped me with the switches, so I think they are mostly working correctly.

The basic set up a cisco asa, with internet plugged into eth0/0. There are two dell PowerConnects connected to eth0/1 and eth0/2. My friend setup LAG between the two switches, and that seems to be working pretty well. In other words, I am on one switch, and I can get to something on the other switch.


At this point, I am just trying to ssh into an outside ip address : 172.16.1.90, and get to an internal address on a vlan : 10.1.132.32. (aka the static route) From the logs, it looks like the cisco asa is not even trying to send that traffic to either of the dell PowerConnects. Furthermore, I am trying to get connectivity out from ip : 10.1.132.32, to the world.

I did have the cisco asa configuration that basically worked without using vlans, but I would really like to do this with vlans to keep my internal networks separate.

Is there something that is clearly wrong with my configuration? I have tried to open up and simplify the configuration as much as I can. Also, is there anything specific I need to do on the PowerConnect switch to make it work with the cisco asa?


Here is the cisco asa configuration:

ASA Version 7.0(7)

!


dns-guard

!

interface Ethernet0/0

speed 100

duplex full

nameif outside

security-level 0

ip address 172.16.1.67 255.255.255.224

!

interface Ethernet0/1

no nameif

security-level 100

no ip address

!

interface Ethernet0/1.10

vlan 10

nameif sw01_network

security-level 100

ip address 10.1.10.1 255.255.255.0

!

interface Ethernet0/1.132

vlan 132

nameif api_network

security-level 100

ip address 10.1.132.1 255.255.255.0

!

interface Ethernet0/1.228

vlan 228

nameif test2_network

security-level 100

ip address 10.1.228.1 255.255.255.0

!

interface Ethernet0/2

speed 100

no nameif

security-level 100

no ip address

!

interface Ethernet0/2.11

vlan 11

nameif sw02_network

security-level 100

ip address 10.1.11.1 255.255.255.0

!

interface Ethernet0/2.20

vlan 20

nameif test_network

security-level 100

ip address 10.1.20.1 255.255.255.0

!

interface Ethernet0/2.52

vlan 52

nameif retail_network

security-level 100

ip address 10.1.52.1 255.255.255.0

!

interface Management0/0

nameif management

security-level 100

ip address 192.168.1.1 255.255.255.0

management-only

!

ftp mode passive


same-security-traffic permit inter-interface

same-security-traffic permit intra-interface

object-group network vlan-test

network-object host 10.1.228.4

network-object host 10.1.228.11

object-group network vlan-api

network-object host 10.1.132.32

object-group network vlan-corp

network-object host 10.1.20.34

object-group network vlan-retail

network-object host 10.1.52.33

access-list outside_access_in extended permit tcp any any eq ssh

access-list outside_access_in extended permit tcp any any

access-list ANY extended permit tcp any any

access-list ANY extended permit udp any any

access-list ANY extended permit icmp any any

access-list LIMIT_IN extended permit tcp any any eq ssh

access-list outside_ssh_in extended permit tcp any eq ssh any eq ssh

access-list outside_access_out extended permit tcp any any

access-list outside_access_out extended permit icmp any any

access-list outside_access_out extended permit udp any any

pager lines 24

logging enable

logging timestamp

logging console debugging

logging buffered debugging

logging asdm informational

mtu outside 1500

mtu test2_network 1500

mtu management 1500

mtu test_network 1500

mtu retail_network 1500

mtu api_network 1500

mtu sw01_network 1500

mtu sw02_network 1500

icmp permit any outside

icmp permit any test2_network

icmp permit any retail_network

asdm image disk0:/asdm-507.bin

no asdm history enable

arp timeout 14400



global (outside) 1 172.16.1.70-172.16.1.72

global (outside) 228 172.16.1.90-172.16.1.92


nat (api_network) 1 0.0.0.0 0.0.0.0
static (api_network,outside) tcp 172.16.1.90 ssh 10.1.132.32 ssh netmask 255.255.255.255


access-group outside_access_in in interface outside

access-group outside_access_out out interface outside

access-group LIMIT_IN in interface test2_network

access-group ANY out interface test2_network

access-group LIMIT_IN in interface test_network

access-group ANY out interface test_network

access-group LIMIT_IN in interface retail_network

access-group ANY out interface retail_network

access-group LIMIT_IN in interface api_network

access-group ANY out interface api_network

access-group LIMIT_IN in interface sw01_network

access-group ANY out interface sw01_network

access-group LIMIT_IN in interface sw02_network

access-group ANY out interface sw02_network

route outside 0.0.0.0 0.0.0.0 172.16.1.65 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00

timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00

timeout uauth 0:05:00 absolute

aaa-server gv protocol ldap

aaa authentication ssh console LOCAL

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

sysopt noproxyarp retail_network



console timeout 0

management-access management

dhcpd address 192.168.1.2-192.168.1.254 management

dhcpd lease 3600

dhcpd ping_timeout 50

dhcpd enable management

!

class-map inspection_default

match default-inspection-traffic

!

!

policy-map global_policy

class inspection_default

inspect dns maximum-length 512

inspect ftp

inspect h323 h225

inspect h323 ras

inspect rsh

inspect rtsp

inspect esmtp

inspect sqlnet

inspect skinny

inspect sunrpc

inspect xdmcp

inspect sip

inspect netbios

inspect tftp

inspect icmp

!

service-policy global_policy global




Any help would be greatly appreciated!

Thanks a head of time,
Aaron

 

[North323]

trying to ssh from the outside? 172.16.1.90 is not a routable IP address, so what is really on the outside? Is there a dsl router that is doing a NAT?

 

[aaron1923]

I changed our outside, routable ips to 172.16 ip addresses as per my boss.

There is no DSL router/modem in front of the Cisco ASA. We are co-located at one of the InterNAP facilities. From them, we get a range of ips; in this case they are 172.16.1.67 - 172.16.1.94. We are using the first one as the ip of the "outside" interface. The gateway for this ip address is 172.16.1.65.

We can set up a second Internet connection with them, that would route to 172.16.1.66, in case you were wondering where that ip went.

Currently when I try this, I am trying to ssh from the outside, aka our office.

Thanks again for any help that you can provide.

Aaron

 

[unclerico]

1) What license do you have?
2) Are you sure that the interfaces on the Dells connecting to the ASA are trunk/tagged ports??

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)

 

[North323]

currently you have: management-access management
need to change that to management-access outside in order to ssh to the 'outside'

 

[aaron1923]

> 1) What license do you have?
> 2) Are you sure that the interfaces on the Dells connecting to the ASA are trunk/tagged ports??

1) The license is something I have wondered about as well. Here is the license we have for the Cisco ASA 5510

License: Base
Max Physical Interfaces: 4
Failover: Disabled
Encryption: 3DES-AES
GTP/GRPS: Disabled
VPN Peers: 50
Max VLANs: 10


2) I think so. Our Dell configs is a bit of a mess. Below is the configuration for one of the dell switches. The cisco is plugged into g1, and the other machine (10.1.132.32) is plugged into either g4, g6, or g8.


interface port-channel 1
flowcontrol on
exit
interface port-channel 1
switchport mode trunk
exit
interface ethernet g1
switchport mode trunk
exit
interface range ethernet g(2-3,5,7,9-40,42,44)
switchport mode general
exit
vlan database
vlan 132,228
exit
interface range ethernet g(4,6,8)
switchport access vlan 132
exit
interface range ethernet g(3,5,7,9-24)
switchport general allowed vlan add 132
exit
interface ethernet g1
switchport trunk allowed vlan add 132
exit
interface port-channel 1
switchport trunk allowed vlan add 132
exit
interface range ethernet g(41,43)
switchport access vlan 228
exit
interface range ethernet g(25-40,42,44)
switchport general allowed vlan add 228
exit
interface ethernet g1
switchport trunk allowed vlan add 228
exit
interface port-channel 1
switchport trunk allowed vlan add 228
exit
interface vlan 132
name api-net
exit
interface vlan 228
name test
exit
interface vlan 228
dot1x guest-vlan
exit
voice vlan oui-table add 0001e3 Siemens_AG_phone________
voice vlan oui-table add 00036b Cisco_phone_____________
voice vlan oui-table add 00096e Avaya___________________
voice vlan oui-table add 000fe2 H3C_Aolynk______________
voice vlan oui-table add 0060b9 Philips_and_NEC_AG_phone
voice vlan oui-table add 00d01e Pingtel_phone___________
voice vlan oui-table add 00e075 Polycom/Veritel_phone___
voice vlan oui-table add 00e0bb 3Com_phone______________
port-channel load-balance layer-2-3
interface range ethernet g(45-48)
channel-group 1 mode auto
exit
interface port-channel 1
gvrp enable
exit
gvrp enable
iscsi target port 860 address 0.0.0.0
iscsi target port 3260 address 0.0.0.0
interface vlan 1
ip address 10.1.10.10 255.255.255.0
exit
ip default-gateway 10.1.10.1
hostname switch_C010
management access-list sw1_conn_1
permit vlan 228
exit
management access-list sw1_conn_2
permit vlan 132
exit

snmp-server community dell_sw1_c010 rw view DefaultSuper


Default settings:

SW version 1.0.2.7 (date 17-Jun-2008 time 20:04:29)
Gigabit Ethernet Ports
=============================
no shutdown
speed 1000
duplex full
negotiation
flow-control off
mdix auto
no back-pressure

interface vlan 1
interface port-channel 1 - 8

spanning-tree
spanning-tree mode STP

qos basic
qos trust cos


Sorry for the long posts, and thanks again for helping me with this.

Aaron

 

[aaron1923]

>currently you have: management-access management
>need to change that to management-access outside in order to ssh to the 'outside'

Thanks for the suggestion, but I don't think that will address my problem. From the outside, I am trying to connect/ssh into a linux machine that is hanging off the dell switch on the inside. I guess that sounds funny in a primarily Microsoft technology forum.

Aaron

 

[unclerico]

check your speed and duplex settings on the dell. in order for a trunk to form the speed and duplex settings must match on both sides. i see 1000/full hard coded on you gigabit interfaces.

I hate all Uppercase... I don't want my groups to seem angry at me all the time! =)
- ColdFlame (vbscript forum)