Cisco ASA 5505 VLAN problems
I have a Cisco ASA 5505 configured with the standard VLANs, 1 and 2, where
1 is the outside interface and 2 is the inside interface on 192.168.2.0.
I have setup VLAN 3 on 192.168.3.0 as a staging area for a new server
farm. I'm unsure as to the license we're using so I entered the no
interface vlan 1 command to be on the safe side (as the manual says that
on the base license we can't have 3 VLANs that can all talk to each other,
you have to disallow it from communicating with the other inside
interface, and at any rate I don't want it to because the two domains have
the same NETBIOS name and the domain controllers like to fight each other
with DHCP and DNS etc.).
EDIT: we are indeed on the base license.
We have a server on the .2 subnet which has a public static IP configured
and works fine from anywhere outside the network but I'm struggling to get
it working from the .3 subnet.
The reason I need this communication is to test exchange migration.
The manual says that by default two VLANs with the same security level
aren't allowed to talk to each other, and since both the inside interfaces
have a security level of 100 I suspect that may be the problem, or the no
forward command, I'm not sure which.
How can I get the traffic to flow from the .3 subnet onto this one address
in the .2 subnet via the public IP?
I did also try defining a route along the lines of route outside <external
address> 255.255.255.255 <ISPs router address> but that didn't seem to
have any effect at all.
When running show version it tells me this about the VLANs:
VLANs : 3, DMZ Restricted
As per ChrisS's advice, I did try same-security-traffic permit
inter-interface and then ran the tracert and http connection again but
nothing changed.
No comments:
Post a Comment