It does not solve the problem if you change the default gateway to the firewall’s address (192.168.6.11). Return packets are still hijacked due to the connected 192.168.6.0 route and not forwarded on the symmetric path. Actually the command blocks the transit traffic between Man0/0 and other interfaces but this is not what we need. It does not fix the problem if the management-only command is set on the ASA’s Management0/0 interface because it does not remove the connected route from the ASA’s routing table. The root cause of the problem is that multiple layer3 devices have the management subnet as a connected route in their routing tables so there is a shortcut when return packets would leave the firewall. The red inbound traffic would choose a different path on the ASA so the connection is broken: The next figure shows what happens if a server in the management network tries to communicate with an Internet server or you try to reach the management station from a remote access VPN (RAVPN) client. If the workstation tries to access the firewall’s management address 192.168.6.11 the return traffic would choose a different path backwards so the connection will be blocked by the firewall. While layer3 switches allow this kind of asymmetric traffic, a firewall does not. It is not difficult to find cases where the return traffic chooses a different path. But now we have multiple Layer3 devices connected to the management VLAN and this causes routing issues. The management workstations and servers can access all network devices now including the ASA within the segment. What is the difference if the Cisco ASA’s management interface is connected to the management VLAN? The firewall is managed via its inside interface so management traffic and user traffic is mixed on the transit VLAN 9. There are no routing problems as the single layer3 exit point is the core switch. The only layer3 device residing in this VLAN is the core switch which is the default gateway in the management VLAN. (-: In this network the layer2 switches and some servers are located in the management VLAN.
Where is the management VLAN located in a typical enterprise network? Let’s see some examples:Įverything is simple until things are simple. Note: the second item restricts the use of multiple NICs (multiple IP addresses) in a server.
Cisco asav routing Pc#
0 kommentar(er)
