Thursday, December 20, 2018

Losing my mind over ASA routing issues...cannot talk to two internal networks from the same subnet

To make a long story short...I've set up a pair of ASAs (5516) for failover with 3 interfaces/IPs and I'm having a particularly odd issue:

​

Gi1/1 -- WAN interface (1.1.1.10/24) -- Security level 0

Gi1/2 -- Internal network A (10.1.0.10/24) -- Security level 100

Gi1/3 -- Internal network B (10.2.0.10/24) -- Security level 100

Gi1/4 -- Disabled

Gi1/5 -- Disabled

Gi1/6 -- Disabled

Gi1/7 -- Failover (stateful)

Gi1/8 -- Failover (status)

I'm able to get Gi1/1 and Gi1/2 both working flawlessly with very standard routes:

ip route 10.0.0.0/8 10.1.0.1 (metric 10)

ip route 172.16.0.0/12 10.1.0.1 (metric 10)

ip route 192.168.0.0/16 10.1.0.1 (metric 10)

ip route 0.0.0.0 0.0.0.0 1.1.1.1 (metric 100)

​

So, I'm just sending everything internal to the gateway for Gi1/2 and everything else going out to the internet via Gi1/1's gateway...but nothing can talk to Gi1/3 with this and that's a problem.

Put another way...10.3.0.100 can talk to 10.1 all day long but 10.2 traffic is broken (due to the static routes?).

​

I've created a workaround by sub-netting our 10.0.0.0/8 into multiple networks to isolate 10.2 on it's own (so I can add a machine to 10.2 for management/monitoring) but there has to be a better way (which allows 10.3 to talk to 10.1 as well as 10.2).

​

We don't have anybody specifically doing networking here and I'm just not familiar with ASAs so I'm sure there's a feature I need to go research/implement (my best guess is Bridging, Route Maps or Traffic Zones)...I'm just hoping to get someone to point me in the right direction

​

Thanks



No comments:

Post a Comment