Can't get traffic flowing between VLANs on an ASA 5505

I've got an ASA 5505 with the Security Plus license that I'm trying to configure.
So far I have setup NATing on two VLANs, one called 16jda (VLAN 16 - 10.16.2.0/24) and one called 16jdc (VLAN 11 - 10.105.11.0/24).
From each subnet I am able to connect to the internet, but I need these subnets to also be able to talk to each other.
I have each VLAN interface at security level 100 and enabled "same-security-traffic permit inter-interface", and I have setup static NAT mappings between the two subnets, but they still can't communicate.
When I try to ping there is no reply and the only log message is:
6 Aug 21 2012 09:00:54 302020 10.16.2.10 23336 10.105.11.6 0 Built inbound ICMP connection for faddr 10.16.2.10/23336 gaddr 10.105.11.6/0 laddr 10.105.11.6/0
I have attached a copy of the router config.

Hi Bro
I know your problem and I know exactly how to solve it too. You could refer to https://supportforums.cisco.com/message/3714412#3714412 for further details.
Moving forward, this is what you’re gonna paste in your FW. This should work like a charm.
access-list from-inside permit ip 10.105.1.0 255.255.255.0 10.105.11.0 255.255.255.0
access-list from-inside permit ip 10.105.1.0 255.255.255.0 10.16.2.0 255.255.255.0
access-list from-16jda permit ip 10.16.2.0 255.255.255.0 10.105.1.0 255.255.255.0
access-list from-16jda permit ip 10.16.2.0 255.255.255.0 10.105.11.0 255.255.255.0
access-list from-16jdc permit ip 10.105.11.0 255.255.255.0 10.105.1.0 255.255.255.0
access-list from-16jdc permit ip 10.105.11.0 255.255.255.0 10.16.2.0 255.255.255.0
nat (inside) 0 access-list from-inside
nat (16jdc) 0 access-list from-16jdc
nat (16jda) 0 access-list from-16jda
clear xlate
nat (inside) 1 10.105.1.0 255.255.255.0 <-- You forgot this!!
Basically, when inside wants to communicate with the other interfaces bearing security-level 100 e.g. 16jda or 16jdc or vice-versa, you’ll need to enable “NAT Exemption” i.e. nat (nameif) 0 . I know you have already enabled the same-security permit inter-interface command, but this command becomes useless once you’ve enable dynamic nat on one of those interfaces. It’s as if the same-security traffic command wasn't even entered in the first place. Hence, the Cisco ASA is behaving as expected as per Cisco's documentation. For further details on this, you could refer to the URLs below;
https://supportforums.cisco.com/thread/223898
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/cfgnat.html#wp1042530

Similar Messages

Can't get a delimiter between Reapting Table Fields using the Double Eval formula.

I have a problem in setting up the "Double Eval" formula, for a repeating table field.
Background:
I have a multiple-selection list box in an InforPath (2010) form. I want to concat all selected values in the list box and display them in a textbox with ";" as delimiter. I've gotten so far that with rules running when the list box is updated, the
textbox content is updated listing the IDs of the selected items (I'm not sure yet if I want to display the IDs or make a lookup for the true text values, but that's another issue for later...).
Problem:
My problem is that I can't get the delimiter between the values. They are all listed in sequence with the ";" delimiter only at the end.
I use the following formula ("Required" is the repeating field)
eval(eval(Required; 'concat(., ";")'); "..")
and get the following result:
What I want to get into the comments text box is the string "684;239;91;".
Any ideas what's wrong with my formula?
(Using InforPath 2010 on a list published to SharePoint 2010.)

Additional info that maybe is important to know:
The multiple-selection list box is getting its values from a secondary data connection using a web service call:
http://MySite/_vti_bin/ListData.svc/MyList?$filter=((CT%20eq%20'Product')%20and%20(CompGroup%20ne%20'OS'))&$orderby=Title
The selections in my list box is yet stored in the field "Required" in a different SharePoint list, we can call it "BaseList", at the same site ("MySite").
So to summerize:
List 1: MySite/MyList
Fields: CT, CompGroup, Title
List 2: MySite/BaseList
Fields: Required
The different lists have more fields of course, but no need to list them all.

How can i get separate passwords between Apple and iCloud?

how can i get separate passwords between Apple and iCloud?

There the same account at this point so theres no way to segragate the password.
You could however make an icloud email address that is different then your primary apple ID that you use for messaging and itunes and apps stores but at this point you cant undo the password merge.

Cisco ASA 5505 - 1st VPN works, 2nd VPN can't get traffic across

This is my first Cisco configuration ever so go easy on me. A lot of the commands that I used here I don't really understand. I got them from Googling configs. I have the need for more than one VPN on this thing, and I've been fighting with this thing for hours today without any luck.
The first VPN I setup, labeled vpn1 here works perfectly. I connect via the public IP on the DSL and I can get traffic to my 192.168.1.0/24 network without any problems.
I pretty much duplicated the configuration for the 2nd VPN, just replacing my 192.168.1.0/24 subnet w/ the network connected to a third interface on the ASA (10.4.0.0 255.255.240.0). I successfully make connection to this VPN, but I cannot get traffic to traverse the VPN. I'm using the address 10.4.0.1 to test pings. The ASA itself can ping 10.4.0.1 as that interface of the ASA has 10.4.13.10 255.255.240.0, which is the same subnet (range is 10.4.0.0 - 10.4.15.255).
Here is my config (edited for names and passwords)
ciscoasa# show run
: Saved
ASA Version 8.2(5)
hostname ciscoasa
enable password ********** encrypted
passwd ********** encrypted
names
interface Ethernet0/0
switchport access vlan 2
interface Ethernet0/1
interface Ethernet0/2
switchport access vlan 3
interface Ethernet0/3
interface Ethernet0/4
interface Ethernet0/5
interface Ethernet0/6
interface Ethernet0/7
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
interface Vlan2
nameif outside
security-level 0
pppoe client vpdn group ISP_DSL
ip address pppoe setroute
interface Vlan3
no forward interface Vlan1
nameif private
security-level 100
ip address 10.4.13.10 255.255.240.0
ftp mode passive
access-list 100 extended permit icmp any any
access-list nonat remark ACL for Nat Bypass
access-list nonat extended permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0
access-list nonat extended permit ip 10.4.0.0 255.255.240.0 192.168.3.0 255.255.255.0
access-list vpn_SplitTunnel remark ACL for VPN Split Tunnel
access-list vpn_SplitTunnel standard permit 192.168.1.0 255.255.255.0
access-list vpn_SplitTunnel standard permit 10.4.0.0 255.255.240.0
pager lines 24
logging asdm informational
mtu inside 1500
mtu outside 1492
mtu private 1500
ip local pool vpn1pool 192.168.2.100-192.168.2.110
ip local pool vpn2pool 192.168.3.100-192.168.3.110
no failover
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
global (outside) 1 interface
nat (inside) 0 access-list nonat
nat (inside) 1 0.0.0.0 0.0.0.0
nat (private) 0 access-list nonat
access-group 100 in interface outside
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
timeout tcp-proxy-reassembly 0:01:00
timeout floating-conn 0:00:00
dynamic-access-policy-record DfltAccessPolicy
aaa authentication ssh console LOCAL
http server enable
http 192.168.1.0 255.255.255.0 inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set strong-des esp-3des esp-md5-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto dynamic-map dynmap 30 set transform-set strong-des
crypto map vpn1 65535 ipsec-isakmp dynamic dynmap
crypto map vpn1 interface outside
crypto map vpn2 65535 ipsec-isakmp dynamic dynmap
crypto isakmp identity address
crypto isakmp enable outside
crypto isakmp policy 11
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 outside
ssh timeout 10
console timeout 0
vpdn group ISP_DSL request dialout pppoe
vpdn group ISP_DSL localname [email protected]
vpdn group ISP_DSL ppp authentication chap
vpdn username [email protected] password **********
dhcp-client update dns
dhcpd auto_config outside
dhcpd address 192.168.1.100-192.168.1.200 inside
threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
webvpn
group-policy vpn2 internal
group-policy vpn2 attributes
vpn-idle-timeout 120
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_SplitTunnel
group-policy vpn1 internal
group-policy vpn1 attributes
vpn-idle-timeout 120
vpn-tunnel-protocol IPSec
split-tunnel-policy tunnelspecified
split-tunnel-network-list value vpn_SplitTunnel
username cssadmin password ********** encrypted
username vpn2user password ********** encrypted
username vpn1user password ********** encrypted
tunnel-group vpn1-VPN type remote-access
tunnel-group vpn1-VPN general-attributes
address-pool vpn1pool
default-group-policy vpn1
tunnel-group vpn1-VPN ipsec-attributes
pre-shared-key **********
tunnel-group vpn2-VPN type remote-access
tunnel-group vpn2-VPN general-attributes
address-pool vpn2pool
default-group-policy vpn2
tunnel-group vpn2-VPN ipsec-attributes
pre-shared-key *****
prompt hostname context
no call-home reporting anonymous
Cryptochecksum:f5137c68c4b4a832c9dff8db808004ae
: end
Theories: after fighting with it for a while and having another guy in my office look at it, we decided that the problem is probably that even though the pings are probably reaching 10.4.0.1, they have no route back to my VPN subnet 192.168.3.0/24. I contacted the admins of the 10.4.0.0 network and asked if they could add a route to 192.168.3.0/24 via 10.4.13.10, but he said there is no router of default gateway on the network to even configure.
So, what do I do? Maybe NAT the VPN traffic? If that is the correct answer, what lines would I put/change in the config to NAT that traffic.
I'm assuming the reason the 1st VPN works is because the ASA is the default gateway for the inside 192.168.1.0/24 network.
Thanks in advance for any insight you can provide.

Hello Belnet,
What do the logs show from the ASA.
Can you post them ??
Any other question..Sure..Just remember to rate all of the community answers.
Julio

Where can I get the realtion between Tcode ,idoctype and message type??

Hello ,
I would like to know the relation between Transaction code,idoc type and Message type.
In which table I can find or which Transatcion I can get all these information..?
Relation with Transaction code is must where can i find....??
Please help me in this....
Thanks in Advance
Regards
Preethi

Hello ,
It was very helpful answer.....
But I want the relation with Transaction code....How can I find the realtion between Tcode and Idoc type or Tcode and message type...??
Please let me know this...
Thanks in advance..
Regards
Preethi

How can I get cover flow to work on a fifth generation Ipod classic

I have a fifth generation Ipod. Is there any way I can get cover flow or something similar? When I'm browsing through my music, I want to be able to see the album cover, rather than just the album title.
Thank youl

Not possible.
tt2

I can't get a reliable wifi signal between my Airport Express in the office and Express in the house and i can't get a cable between the two. Any suggestions for getting internet connection in both buildings?

I need to get internet to both the house and my office, which is in a separate building approx 20m from the house. I was advised by Apple to buy an Airport Express, set it up on one or other building, and connect wirelessly to the other. Tried that, but couldn't get a reliable signal.
I was then advised to buy another Airport Express and use it as an expander in the other building. Trouble is, i can't get a reliable wireless signal between the two Expresses, so it keeps dropping the connection, and is slow when it is connected.
I rang Apple again and was told that i could try a third Airport Express between the two existing ones, but that is impossible as there is only outdoors between the two.
It would be very difficult and expensive to get an ethernet cable between the two buildings (have to cut through concrete etc), and I see from the discussion forums that an Airport Extreme has the same wireless signal as an Express, so replacing one of the Expresses with an Extreme seems unlikely to resolve the problem. Can anyone think of any other options?

The Powerline adapters mentioned by edex67 are your only hope if you cannot run an Ethernet cable.
Even if the home and office are on the same electrical circuit, you won't really know how well the Powerline adapters might work until you actually try them out at your location.
For that reason, it would be a good idea to understand the store's return policy before you buy.

Can't get a comparison between a folder name and a string to work

Dear community,
I have a really simple ExtendScript-example that I just can't get to work and I have no idea what could be wrong. I'm trying to write a script that goes through all the items in the project panel and stores references to all the folders which names are like "layer1", "layer2", and so on, in an array. This is the code that should alert 3 times in my case, but it doesn't alert once..
for (var i=1; i<=app.project.numItems; i++)
 if ((app.project.item(i) instanceof FolderItem) && (app.project.item(i).name == "layer"+i))
 alert("found folder = " + app.project.item(i).name);
Inside the project in the root-directory there are 2 comps and 3 folders named 'layer1', 'layer2' and 'layer3' - so I should see 3 alerts when executing the above script. For testing-purposes I changed the second part of the if-statement to a 'static' value like so:
.. && (app.project.item(i).name == "layer1")) --> then it works! But I need a dynamic solution..
Thanks very much for ANY help in advance!
Greetings,
Gilbert

I just tried the code and it only alerted once for me. The issue with your code is that it requires the "Layer" named folders to always be the first x items in the project file. So what is happening for you is that...
If any item appears before the first "Layer" folder then you are effectively comparing random names to each other that will never match.
ItemSomethingElse
RandomFolder == Layer1 (false)
Layer1 == Layer2 (false)
Layer2 == Layer3 (false)
Layer3 == Layer4 (false)
Layer4 == Layer5 (false)
ItemSomethingElse
What you need to do to keep it dynamic:
1) Gather instances of all the folders in your project into an array.
2) Loop through that array checking for indexOf "Layer".
3) If there is a match...
4) Compare that name in another loop. You'll have to determine the max number to loop through for your search, like 25 or 50 or something that won't loop forever.
5) If a Layer# match is found then run your alert.
ItemSomethingElse
RandomFolder indexOf("Layer") (false, do not add)
Layer1 indexOf("Layer") (true, add instance to folderArray)
Layer2 indexOf("Layer") (true, add instance to folderArray)
Layer3 indexOf("Layer") (true, add instance to folderArray)
Layer4 indexOf("Layer") (true, add instance to folderArray)
ItemSomethingElse
So something like this should work:
var folderArray = new Array();
//Loop through project grabbing folders with layer in the name
for (var i=1; i<=app.project.numItems; i++){
 var curItem = app.project.item(i);
 if(curItem instanceof FolderItem && curItem.name.indexOf("layer") != (-1)){
 folderArray[folderArray.length] = curItem;
//Set cap for number appended to "layer"
var cap = 25;
var curName;
var folderArrayLength = folderArray.length;
//Loop through new "layer" array
for(var l=0; l<folderArrayLength; l++){
 for(var c=1; c<cap; c++){
 //Dynamic name
 curName = "layer"+c.toString();
 //Current folder name
 folderName = folderArray[l].name;
 //Compare them, alert if the match
 if(folderName == curName){
 alert("found folder = " + folderArray[l].name);
 break;//End comparison once found

Persistent VPN between PIX 501 and ASA 5505

I am a networking newbie with 2 small retail stores. I would like to create a persistent VPN between the stores. I already have a PIX 501 firewall, and I am looking at getting an ASA 5505. Would I have any problems creating a persistent VPN between these two firewalls?

No problems whatsoever :-)
There are loads of examples for the config on the Cisco website, and basically these boxes can run exactly the same software, so the config on each is virtually the same. Main difference is the ASA defines the interfaces in a different way. Even if you have different versions of software, say 6.3 on the PIX and 7.2 on the ASA they will still work fine for the VPN, just the configs will be a lot more different. Hope this helps to remove any worries you had?

Unable to ping device behind Cisco 3750 on the same inside VLAN via Cisco ASA 5505 Anyconnect VPN

Hi Guys,
I've been stuck with this for the last 2 days, and I thought to try and use Cisco's forum, I setup my home DC, and started having problems once I moved a Cisco 5505 behind a Cisco 1841 router (I wanted to eventually test DMVPN live on the internet,) I was no longer able to ping some devices, then as soon as I introduce a collapsed core/distribution switch, I'm also no longer able to ping the devices behind the Cisco 3750, I've attached a network diagram and the ASA running-config.
Everything seem fine internally with the exception of an intermittent network connectivity with a Citrix NetScaler VPX running on a VMware ESXi.
For some odd reason, I am able to ping the following, with no issues.
Cisco 3750 SVI (192.168.1.3)
CentOS web server (connected directly to the Cisco ASA 5505)
I have checked and enable the following:
Nat Exemption
Sysopt connection permit-vpn
ACL's
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
Added ICMP in the inspection policy
Packet-capture - Only getting echo requests.
Thanks in advance!

Hi,
I believe you have the problem with your no-nat configurations..... you to exempt NAT for the traffic from 172.16.10.0 (Anyconnect VPN pool) to 192.168.1.0/24 (Inside LAN) to make this work
object network acvpnpool
subnet <anyconnect VPN Subnet>
object network insidelan
subnet <inside lan subnet>
nat (inside,outside) source static acvpnpool acvpnpool destination static insidelan insidelan
Make sure that you are able to reach the GW/Inside ip adress of the firewall from LAN machine.... all routing in place properly..... Thanks!!!
Regards
Karthik

Can't get Cover Flow to keep previous window settings, help?

I'm sure that there is some easy quick fix to this but I couldn't find it anywhere doing various web searches. Anyway, I'm new to Snow Leopard and I've noticed a very irritating difference/glitch/whatever between it and Leopard.
I am a graphics guy and I always used Cover Flow in Finder to search through my documents and files and heap of images. The old Cover Flow view always opened new windows to the size and proportions (image vs. text) as my previous window(s). In this new Snow Leopard that I installed, whenever I open a new Finder window in Cover Flow it gives me this huge 90% image view with just this small 10% file texts at the bottom of the window. Each time I have to click and drag the divider bar back up to the 50% line. If I click on a file, again, the view jumps to this flippin' huge image view and I have to drag the divider back up to the middle.
Is there anyway to get Finder to be like in the old Leopard where it remembers that I want Cover Flow to always be a 50/50 split between seeing the images and the file names? Its driving me crazy. I would assume there is just some little button or something that I am missing. Thanks.

I gave that a try and it "kinda" works but doesn't really solve the annoyance. If you resize it again in the slightest or shift the divider bar, the whole thing jumps back to the 90/10 view. Why!?!?! Does that not drive anyone else insane?
Thanks for the duct tape fix though Captfred. I can at least use that in the mean time. I really hope they fix that problem with the next update. It worked just fine before, but now it makes cover flow somewhat unusable.

Can't get Optical Flow to render

I've read a couple of posts about other people having this problem, but they don't seem to apply as I can't find a workaround. I'm running FC 10.0.8.
If I render my timeline (about 15 minutes), the entire timeline renders, except for about five seconds that are in slow motion. The orange bar remains above that section even after the entire timeline is rendered.
After reading the other posts, I know the following might be relevant: I'm editing optimized AVCHD footage. There is no speed ramp. It's just a clip at slowed to 50%. The clip is completely separate (it's not just a selected range--in another post, somebody said just selecting a range was their problem).
I also tried creating a new project, bringing in a short clip (and nothing else), slowing it to 25%, and rendering all. The percentage display counted up to 100% like the clip was being rendered, but, at the end, the timeline still showed orange above the retimed clip.
I should say that I don't know if the clips are actually rendered properly in Optical Flow. I'm not sure I'd be able to tell the difference. All I know is that the timeline is still showing orange above them, so I'm presuming they aren't.

Russ--
Funny thing. I decided to test this by taking the same very brief clip and putting it into a timeline three times in a row. Then I made each slow motion 25%. Then I left the first normal, made the second frame blending, and the third optical flow. Then I exported the master file.
I guess I can see a difference, but the optical flow section actually looks kind of blurry to me.
Then I went back to the timeline and chose Modify> Render All. And FCX rendered the entire timeline, with no orange above any portion (not even the Optical Flow portion).
So I don't know what to think now. I don't know what the problem was, or if optical flow is any better than normal or frame blending. Maybe I need to try it with some different footage?

How can I get more space between items in a line of text .. elegantly

Ok I have some equations that follow each other in a text line, eg
Xc=10^6/2 pi f C Xc = 10^6/2* pi *50 * C Xc = 10^4/pi C ................. etc.
Is there some way I can eg put a css entity in the paragraph so I can dimension the space as a box?
I've tried with a but it just includes the statement as text.
And if i put Xc=10^6/2 pi f C etc
it puts the equations on different lines.
And multiple s is a cludge, so is invisible images. There MUST be a nice way to do this?

One way is to do something like this:
1) create your styles like this:
span {
 font-family: "Courier New", Courier, monospace;
 letter-spacing: 3px;
2) create your HTML like this:
 Xc = 10^6/2* pi *50 * C Xc = 10^4/pi C 
Now is this what you are looking for? If not please post back so that something else can be suggested like Math HTML such as this one:
<MATH>∫_a_^b^{f(x)<over>1+x} dx</MATH>
FF and latest IE9/10 supports MAtH HTML as far as I know.
This is the picture of display in IE10:
Good luck.

Hi, I want to download my music library from my iPad to my IPhone via Bluetooth but can't get a connection between the devices??? Help please

Hi, I want to download my music library from my ipad2 to m iphone4 by Bluetooth but the devices won't connect. Both devices have Bluetooth turned on. Help please.

Can't sync them like that. Update both to iOS 5 and sync both with iTunes then set up iCloud. All new purchases will be automatically downloaded to both devices when you turn on automatic downloads in the settings.

How I get random number between 1 and int number ?

how can I get random number between 1 and int number
like between 1 and 10 etc.
10x

Use the nextFloat() method of the Random class, this returns a random number between 0.0 and 1.0. To get and integer range from that multiply the return value of that method call by the integer range you need (in this case 10), and add the starting number you want returned in the range (1 in this case). The code below works for numbers 1-10.
Random r = new Random();
int x = (int)(r.nextFloat()*10) +1;

Can't get traffic flowing between VLANs on an ASA 5505

Similar Messages

Maybe you are looking for