Pinging ASA From Switch fails

Hi
I have setup a lab but just wanted to know why this ping does not work.
3750Switch ---------------------ASA5505
So basically a switch is connected to the asa. I have carried out the below config. When both sides are configured on VLAN1 then the pings work. When I put the both on any vlan apart from vlan 1, although both ends are still in the same vlan, the pings fail.
for example if both ends are in the default vlan1, pings ok. if both ends in say vlan 20, pings fail. interface do have no shuts done and all are showing up
3750Switch
Int fastethernet 0/1
switchport trunk encapsulation dot1q
switchport mode trunk
Interface vlan 20
ip address 192.168.1.10 255.255.255.0
ASA5505
Int vlan 20
nameif INSIDE
security-level 100
ip address 192.168.1.11 255.255.255.0
int ethernet 0/0
switchport access vlan 20

The issue appears to be a mismatch between trunk port and access port. You have configured the switch interface as a trunk port which means that for vlans other than the native vlan 1 the switch will send frames with vlan tags. But the interface on the ASA is configured as an access port and will expect frames with no vlan tag.
One simple solution would be to configure the switch trunk port to specify vlan 20 as the native vlan. Then frames for vlan 20 would be sent without tags and the ASA would recognize them.
HTH
Rick

Similar Messages

Telnet to ASA from Nei Switch

Hi Everyone.
I have ASA connected to Switch.
This is outside connection.
I was trying to Telnet to ASA from Switch which has outside connection to ASA.
I config the command
telnet 192.168.0.0 255.255.0.0 outside
Still from Switch i am unable to telnet to ASA ?
ASA has default route to switch with route outside command
Need to know things below
1>Is this possible to Telnet to both outside and inside interface of ASA from the nei switch which is on outside interface of ASA ??

Hello,
So this means that outside interface is never allowed telnet by design right?
Correct,
As I mention on my previous post
Also you cannot access a distant-interface, this means from an inside user you will be able to access inside interface but traffic to outside interface ip address will be denied no matter what ( Security desing meassure)
Regards
Remember to rate all of the helpful posts

Cisco ASA 5505 performance issues on downloads - data into the ASA from the Internet

I have having serious issues with performance on my ASA 5505s that I am testing with 9.2.3 code.
I stripped the config and removed as much stuff as I could - no VPN etc. and I am ONLY getting about 30-40Mbps downloads from sites but 95Mbps uploads???? Anyone else seeing these problems? If I remove the firewall my PC can hit 300/300Mbps to the same sites using the same switch and cable.
I installed 1Gb of mem on the ASA 5505 but it made no difference. The ASA has a UL IP Security license but I am only using and inside and outside address for these tests, no other ports configured.
Is anyone else seeing this performance problem with the 9.2.3 code? I went to this from 8.2.5 to try to resolve QOS failure bugs that I found in the 8.2.5 code. I did not expect to have a performance hit though and it is only on downloads TO the ASA from the Internet from all speed test sites that I try. Uploading speeds seem fine. No access-lists on my interfaces either...barebones config.
My FIOS and switch interfaces are fine...no errors on any interfaces and the same switch interface hits 300/300Mbps when my laptop is directly attached.
Anyone have a barebones config on their ASA 5505 that flies...I will try it on mine and see if some command somewhere (hidden) is causing the issue. I even cleared the config and started with a clean slate just in case I was missing some command from the older configs that may have impacted performance.

After changing the switch with a high end switch my performance increased but I am still not happy with the throughput out of my ASA. I have about 50+ ASAs 5505s and a dozen 5510s. Most remote sites have 5505s. All my sites right now have 8.2.5-51 and I wanted to put 9.2.3 out there to solve issues I have uncovered on the 8.2.5 code with regards to QOS issues.
I get much better results using the Cisco 3750X attached to the FIOS (right around 300/300 with my laptop directly attached to the 3750x bypassing the ASA - my FIOS circuit rating is also 300/300). Going through the ASA to the same test site I get download speeds of 35 to 75. Changes randomly which really bothers me. My uploads speeds are ALWAYS faster then my download speeds. Example - best download I would ever get is 75Mb and my upload would usually hit 95Mb during the same test period.
I may have to live with it but the inconsistency is what really bothers me.
Here is the config I am currently using. Nothing going on during testing since only a single PC is attached. VPN tunnel to the main site can be up or down...doesn't seem to make any difference. PC does to site directly from outside interface of ASA...split tunneling. Even when I removed tunnels and tested with just the ASA as a firewall to the Internet I was still seeing the same inconsistencies.
Anything obviously missing - new command or anything? Xlates causing issues?

Recover an iMovie from a failed external drive?

Has anyone been able to get an entire iMovie recovered from a failed external Firewire drive? My LaCie just won't power up despite having its light come on, and having other external drives connected through it to my iMac and working fine.
I was about to do some backing up after finishing some edits on my latest iMovie, located on that drive. The edits were taking a longer time than usual, with spinning beach ball going on and on, so I decided to restart the Mac and see if that would speed things up. A restart resulted in a totally white screen for over 20 minutes, so I powered off with the switch, and powered on again with it a few minutes later. After three tries, including trying to boot from the installation disk, the iMac sprang to life again, and three of my external drives came on as usual, but not the La Cie that has my iPhotoLibraries and the iMovies I am working on. It is not a problem with power cords or the Firewire cables, as I swapped them out with the other drives, and everything works except this drive will not power up. Its light comes on, and the Firewire ports allow the other drive to come on, as this one is the one connected to the iMac, but the drive remains cold and quiet, just sits there with its blue light blinking.
I just need it to power on long enough to transfer my data to another drive.
I will settle for drive-recovery if that means I will get all my movies and photos back......anyone ever had to use a drive recovery service for this? If so, how did it work?
I do have backups for the photos, but not all of them as I don't usually backup every day. The movies will have to be recreated I can do this, it will just take lots of time......
not happy with this situation....any support/sympathy greatly appreciated!

Beverly Maneatis wrote:
.. The drive comes on and its light blinks, but does not progress to the drive powering up and the light becoming a solid nonblinking. ..
sorry to contradict you, Bev, but the drive itself has no lights.. :
(pic by wikipedia)
THIS is your drive with your precious data .. no blinks ...
ok, I'm a typically 'Tim Taylor/Home Improvement'-guy (incl. friends in hospital...), so maybe a daredevil about screwing things up/open (pun-taaaa). if you open the housing (usually 4 screws on bottom), you would see a power-supply, some small board for the interface electronics, a fan, some small board for some other electronics. and two cables: one with 4 cables (=power), one flat cable with ~20something wires (=data).. the drive is fixed with another four screws.. it is really dead easy, and you can not damage the drive itself, except you wear some angora and plastic sandals, to get some zillion of volts of static electricity into your fingertips ...
so, if you find a nice PC-guy, ask him to place the drive into another housing (usb or fw.. doesn't matter...).. for a pro, that is a 5min procedure.. I'm pretty sure, it will work! < fingers crossed > < throwing ash over shoulder > < murmering some Hun's incantaion >

Connecting ASA from inside of the network

The LAN has 10.10.10.0/24 ip pool and ASA has 10.10.11.0/24 pool. When i connect to the ASA from the inside of the network , i can't get to any node in the network but i can when i am outside of the network. I need to connect to all nodes even when I am inside of the network connecting to ASA. please advise.

John,
Understand now, Hmmm.. indeed strange, this is what we could do to try isolating the problem and try confirming some local connectivity.
since 10.10.10.0/24 is routed through the ASA firewall 10.10.10.254 as all hosts default gateway load your asdm real time log and note traffic while trying to ping from user labtop to any other hosts on the same 10.10.10.0/24 segment, I am sure you have probably checked but from the users labtop have you verify machine is getting proper 10.10.10.x address with correct mask and DG given from ASA DHCP, if ASA is your inside DHCP server go to ASA command lline and issue.
asa#show dhcpd binding - to confirm hosts IP assigement is there for
try pinging from the ASA itself towards that particular users 10.10.10.X address to confirm local connectivity from asa to labtop.
Also from the labtop take note of complete output of ipconfig : and note all its current adapter bindings .
c:\ipconfig /all
It seems this could be more of a settings issues on the machines but confirm above.
Also what ASA code version ? show ver
and what version os VPN client ?
Rgds
Jorge

WRT610N to TP-LINK SWITCH cannot ping printer on switch

I hope you can tell me what I have done wrong.
dslmodem ---> wrt610N ---->TP-LINK(5port) ---- HP 2600N printer, another to IOmega HD
I cannot see either the printer nor the HD. I cannot ping them.
The cables from the TP to the printer are blue, CAT5 cables. Does blue mean twisted pair?
The HP and IOmega have static IP addresses at 192.168.1.2 and 192.168.1.3 each.
The DHCP settings on the router allocate DHCP from 100-254 to avoid conflicts.
The firewall on the WRT610N is disabled.
Physical limitations permit only one CAT5 cable to the TPLINK box.
If I avoid the box and do this;
dslmodem ---> wrt610N ---->HP 2600N printer
I can ping it from both a Windows 7 and/or XP machine.
However, with the switch in place, I cannot ping it from the router nor any PC's connected to it. The PCs can ping each other.
Could someone please tell me what I am doing wrong?
Thank you in advance.

The device is a TPLINK TL-SF1005D unmanaged 5 port switch. No visible settings or buttons.
The address handed out on other side of the TPLINK is 169.254.138.233
My network is 192.168.1.*
Hmm. This does not bode well.
Should I set up a routing table entry to talk to this switch?
The wire from the router is hooked to port 1 on the switch. Should it not pick up the right submask, entry from the router?
Thanks for all your help?
------------------------------------DUMP------------------------------------------------------
Microsoft Windows [Version 6.1.7600]
Copyright (c) 2009 Microsoft Corporation. All rights reserved.
C:\Users\abbu>ipconfig /all
Windows IP Configuration
   Host Name . . . . . . . . . . . . : abbu-VAIO
   Primary Dns Suffix . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : No
   WINS Proxy Enabled. . . . . . . . : No
Ethernet adapter Local Area Connection:
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Marvell Yukon 88E8059 PCI-E Gigabit Ether
net Controller
   Physical Address. . . . . . . . . : 54-42-49-02-CA-BC
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d08e:934c:6554:8ae9%12(Preferred)
   Autoconfiguration IPv4 Address. . : 169.254.138.233(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.0.0
   Default Gateway . . . . . . . . . :
   DHCPv6 IAID . . . . . . . . . . . : 385885374
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-32-51-44-54-42-49-02-CA-BC
   DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1
                                       fec0:0:0:ffff::2%1
                                       fec0:0:0:ffff::3%1
   NetBIOS over Tcpip. . . . . . . . : Enabled
Wireless LAN adapter Wireless Network Connection:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . : lan
   Description . . . . . . . . . . . : Atheros AR9285 Wireless Network Adapter
   Physical Address. . . . . . . . . : 2C-81-58-FD-87-69
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.lan:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.{6DD0B22D-C026-4940-9700-1362E8BA5673}:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Teredo Tunneling Pseudo-Interface:
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
C:\Users\abbu>

Sudden Ping Drop from Default Gateway in VLAN

Hi,
We have a Layer3 Switch 3560 and we have configure multiple VLANs along with SVI on it. We have then cascade layer2 Switches (Cisco 2960) with 3560 by Trunk links. Now we are facing problem on one VLAN that users are in specific VLAN sudden get ping drop from their default gateway (SVI on Cisco 3560) and this problem is not come with all users in that VLAN as just few users in a single time face this problem. When we unplug the systems for few second and reconnect then problem get resolved for few minutes till hours.
Kindly guide me to resolved this.
Regards,
Arshad

I have also clean the arp cache on users systems by using "'netsh interface ipv4 delete arpcache" but in vain. Now i have perform the below steps and operation is working fine since last 20 hours approx.
1- Change the First Casade Switch Cisco 2960.
2- Remove EtherChannel and Change the Backbone port on Cisco 3560 and Cisco 2960.
3- Connect both switches with single backbone Gig Port.
4- IOS Version on previous Cisco 2960 switch was IOS 12.2(50)SE3 and the IOS Version on newly installed switch is IOS 12.2(50)SE5

Monitoring and Pinging ASA over VPN

I hope you guys will be able to help me on this. I have two ASA running 7.2(3) and 7.2(4) respectively, which is connected via site to site VPN. I have no problem getting the VPN to work. However I have been trying to setup monitoring of the VPN's utilization of the for siteB ASA from siteA without any success. Also can anyone share how to get ping and traceroute working from siteA to siteB, meaning traffic travel via the tunnel and get a ping and traceroute response from the inside and outside interface.
I have tried adding
icmp permit any any echo-reply inside
icmp permit any any echo-reply outside
and also permit icmp from outside to inside but not working
All help is appreciated.

Hi,
Check out VPNTTG (VPN Tunnel Traffic Grapher) is a software for SNMP monitoring and measuring the traffic load for IPsec (Site-to-Site, Remote Access) and SSL (With Client, Clientless) VPN tunnels on a Cisco ASA. It allows the user to see traffic load on a VPN tunnel over time in graphical form.
Advantage of VPNTTG over other SNMP based monitoring software's is following: Other (commonly used) software's are working with static OID numbers, i.e. whenever tunnel disconnects and reconnects, it gets assigned a new OID number. This means that the historical data, gathered on the connection, is lost each time. However, VPNTTG works with VPN peer's IP address and it stores for each VPN tunnel historical monitoring data into the Database.
For more information about VPNTTG please visit www.vpnttg.com

ASA , 3750 Switch stack ,Etherchanel cross-stack and HA

Hi Guys,
I have run into a scenario where there they use a switch stack of four 3750’s and two ASA 5540 in Active-stanby HA Pair.
ASA's are connected with 4 interfaces across stack (1 interface to each switch).
1 Etherchannels (4 ports) is configured between ASA and switch. All vlans are terminated on ASA as a subiterfaces.
somehting like:
Port-channell1
no ip address
Port-channell1.10
vlan 10
ip address 192.168.10.1 255.255.255.0 stanby 192.168.10.2
Port-channell1.20
vlan 10
ip address 192.168.20.1 255.255.255.0 stanby 192.168.20.2
..and so on..
There is about different 60-70 vlans currently terminated on ASA.
We found a problem with failover testing:
When we test the failover and fail manually with “failover active” command,
It looks like only 29 vlans can fail to backup ASA instantly , the rest can take up to 5 min.
Is there a limitation for ASA or 3750 etherchannel in this scenario why it would not failover instantly for all vlans ?
Thanks
Martin

sory mistake there :
Port-channell1.20
vlan 20
ip address 192.168.20.1 255.255.255.0 stanby 192.168.20.2
Martin

Data import from EBS failed via FDMEE in fdm . Getting error message as "Error connecting to AIF URL.

FDM Data import from EBS failed via FDMEE after roll back the 11.1.2.3.500 patch . Getting below error message in ERPI Adapter log.
*** clsGetFinData.fExecuteDataRule @ 2/18/2015 5:36:17 AM ***
PeriodKey = 5/31/2013 12:00:00 AM
PriorPeriodKey = 4/30/2013 12:00:00 AM
Rule Name = 6001
Execution Mode = FULLREFRESH
System.Runtime.InteropServices.COMException (0x80040209): Error connecting to AIF URL.
at Oracle.Erpi.ErpiFdmCommon.ExecuteRule(String userName, String ssoToken, String ruleName, String executionMode, String priorPeriodKey, String periodKey, String& loadId)
at fdmERPIfinE1.clsGetFinData.fExecuteDataRule(String strERPIUserID, String strDataRuleName, String strExecutionMode, String strPeriodKey, String strPriorPeriodKey)
Any help Please?
Thanks

Hi
Getting this error in ErpiIntergrator0.log . ODI session ID were not generated in ODI / FDMEE. If I import from FDMEE its importing data from EBS.
<[ServletContext@809342788[app:AIF module:aif path:/aif spec-version:2.5 version:11.1.2.0]] Servlet failed with Exception
java.lang.RuntimeException
at com.hyperion.aif.servlet.FDMRuleServlet.doPost(FDMRuleServlet.java:76)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:727)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:301)
at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:27)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
at oracle.security.jps.ee.http.JpsAbsFilter$1.run(JpsAbsFilter.java:119)
at oracle.security.jps.util.JpsSubject.doAsPrivileged(JpsSubject.java:324)
at oracle.security.jps.ee.util.JpsPlatformUtil.runJaasMode(JpsPlatformUtil.java:460)
at oracle.security.jps.ee.http.JpsAbsFilter.runJaasMode(JpsAbsFilter.java:103)
at oracle.security.jps.ee.http.JpsAbsFilter.doFilter(JpsAbsFilter.java:171)
at oracle.security.jps.ee.http.JpsFilter.doFilter(JpsFilter.java:71)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
at oracle.dms.servlet.DMSServletFilter.doFilter(DMSServletFilter.java:163)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
at weblogic.servlet.internal.RequestEventsFilter.doFilter(RequestEventsFilter.java:27)
at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:57)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3730)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3696)
at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2273)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2179)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1490)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:256)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:221)

Downloads from itunes fail - error code 8003 - what does that mean, or more importantly, how do I get what I paid for?

Downloads from itunes fail - error code 8003 - what does that mean, or more importantly, how do I get what I paid for?

Try the troubleshooting for that error code on this page : iTunes: Advanced iTunes Store troubleshooting - Apple Support (search for '8003' on the page, it's just below half-way down)

I have like five GB's of ghost data (data the device claims is not there but it is still taking up space) on my I pad 2 from a failed movie download attempt. How do I fix that with out resting my iPad? I have only 1GB left of storage

I have like five GB's of ghost data (data the device claims is not there but it is still taking up space) on my I pad 2 from a failed movie download attempt. How do I fix that with out resting my iPad? I have only 1GB left of storage
The movie had gotten to the point that I could watch it all the way through but it still said processing and got stuck at that point and when I turned off the wifi to try to restart it, it deleted its-self but did not free up any of the storage It was taking up
Restarting my iPad does not help
Some thing similar also happened to my old laptop when trying to download the iOS 5 update to my laptop when it came out. It kept getting disconnected and every time it would try to start over and act like what had already been downloaded was not there though it was still taking up the storage space.
And it continued repeating until it took up all of my storage space. The data file would not show up anywhere so I had to restore my laptop to the factory settings and that worked for awhile but I eventually had to get a new laptop.

Did you try to set it up as new device, as explained in this article?
How to erase your iOS device and then set it up as a new device or restore it from backups
If this does not work, use iTunes to set it back to factory settings, which would also install the latest software:
Use iTunes to restore your iOS device to factory settings - Apple Support

Is there a way to stop the OS from switching to a newly opened app? I would like to be able to continue what I'm doing while I wait for an app to launch and not get interrupted by a forced entry into the app.

Is there a way to stop the OS from switching to a newly opened app? I would like to be able to continue what I'm doing while I wait for an app to launch and not get interrupted by a forced entry into the app.
As an example, I'm going to my email in safari, while I wait for it to load, I open an excel document, and the OS decides excel should be the front app, so I go back to safari so I can enter my login info, but halfway through my password the OS decides that excel is where I should finish typing my password.
VERY ANNOYING. Can I open apps in the background?

Thank you everyone for the suggestions. J D, I'm not a terminal fan, but I'm sure it works. I found a solution that I can use in the dock from another post.
Annoyed by Mac OS
Works great and allows me to maximize those multitasking minutes.

How do I stop firefox from switching to new tab when opening bookmarks in new tab

When I open a link in a new tab it does not switch to it automatically. I had to reinstall firefox to stop it from switching to new tabs automatically since the option being unticked didn't stop it from happening anyway. Now only when I open a bookmard in a new tab it still switches to the new tab and I do not want it to. Why is it doing this with the option unchecked and a fresh install with no add ons of any sort? And how do I make it stop?

Try to set the Boolean pref browser.tabs.loadBookmarksInBackground to true on the about:config page.
*http://kb.mozillazine.org/about:config

My hard drive failed. My applications were on the drive including Excel, Word, and Powerpoint. Apple told me I could pull everything from the failed drive. I tried that but the drive is bad so I can't get to anything. Do you think Apple will reinstall?

My hard drive failed. My applications were on the drive including Excel, Word, and Powerpoint. Apple told me I could pull everything from the failed drive. I tried that but the drive is bad so I can't get to anything. The Office package was installed/included when I purchased the Mac. Does anyone think Apple will provide me with the Office package? Thank you!

Thank you everyone. I apologize to confusing all but I am up to date and running OS X 10.8.2. It's possible I purchased the key for Office but I don't think so although it was 3-4 years ago. I guess I will stop in the Apple Store and just ask. I may just buy the new bundle anyway to get the most updated.
I have read there are issues with the MS Office bundle running on our latest OS, is that true?
Thank you all!!! You've been great!

Pinging ASA From Switch fails

Similar Messages

Maybe you are looking for