• Some users have recently had their accounts hijacked. It seems that the now defunct EVGA forums might have compromised your password there and seems many are using the same PW here. We would suggest you UPDATE YOUR PASSWORD and TURN ON 2FA for your account here to further secure it. None of the compromised accounts had 2FA turned on.
    Once you have enabled 2FA, your account will be updated soon to show a badge, letting other members know that you use 2FA to protect your account. This should be beneficial for everyone that uses FSFT.

ARP?

J

jenuster

Limp Gawd
Joined
Mar 8, 2011
Messages
154
I just noticed some interesting results in my home lab.

I have a Cisco Router that has two interfaces (one for inside network, the other for the internet).

I decided to add a Cisco ASA into the mix and set it up the same way I did the router.

By the way both devices are plugged into the same switch.

So here's the interesting part: when I have the computer's gateway set as the interface of router (192.168.1.3), I have no issues connecting to the internet and during this time I am able to ping the ASA's inside interface (192.168.1.1)

As soon as I change my PC's gateway to 192.168.1.1 (ASA's interface), the pings get timed out.

Any idea what might be happening here?
 
Post your config and routing table for the ASA. If the ASA's default gateway is the router (.3), that will be a problem.

Also, is it just ping that isn't working, or are you unable to browse as well? ICMP may not be allowed through the ASA.
 
I am confused what routing has to do with him pinging an interface on the lan?
 
Ah, I thought it ping to something on the internet was dying.

As far as what's happening here, I don't know. It shouldn't be an ARP issue as no IPs are changing, just the gateway the host is pointing to. First question is how long are you letting the ping go after changing the host's IP settings? Maybe it's bouncing and you're not waiting long enough for it to come up?
 
Could be an ARP problem if the network he normally uses that PC on has a default GW of 192.168.1.1 and he is taking his cable and putting it to the lab?
 
what ping's timeout? to the ASA? to the router? to the internet?

where are you plugged in? i don't see how you can have your inside router interface and your ASA inside interface in the same network.

I am imagining the setup something like this:

Internet --------- outside (router) inside ------------ outside (ASA) inside ------------------ laptop/PC

the network between the router and ASA needs to be different from that between the ASA and computer. Also, on the ASA, you have to enable the ability for it to respond to ICMP. I think it's something like "icmp <allowed network> <allowed network mask> <interface nameif>".... or something like that.

are you sure there's not another system that has 1.1 IP configured on it? I think we need more information on the layout.
 
berky said:
what ping's timeout? to the ASA? to the router? to the internet?

where are you plugged in? i don't see how you can have your inside router interface and your ASA inside interface in the same network.

I am imagining the setup something like this:

Internet --------- outside (router) inside ------------ outside (ASA) inside ------------------ laptop/PC

the network between the router and ASA needs to be different from that between the ASA and computer. Also, on the ASA, you have to enable the ability for it to respond to ICMP. I think it's something like "icmp <allowed network> <allowed network mask> <interface nameif>".... or something like that.

are you sure there's not another system that has 1.1 IP configured on it? I think we need more information on the layout.
Click to expand...

He has both connected to the same switch and switched between which one goes to the internet.
 
AMD_Gamer said:
Could be an ARP problem if the network he normally uses that PC on has a default GW of 192.168.1.1 and he is taking his cable and putting it to the lab?
Click to expand...

He says both devices are plugged into the same switch. So assuming that's true, and he doesn't have conflicting .1s, I don't see how it could be an ARP issue.

If I'm understanding it right (big if, at this point), it's a single subnet/broadcast domain, all three devices are connected to the same switch. He's got .3 (router) as his gateway and is pinging .1 (ASA). He then changes the gateway to .1 (ASA) and the ping dies. No idea why this is happening, and I don't think it's an ARP thing.

I'm not clear on how the ASA is connected to the internet, which is why I asked if its default route is pointing to the router. If this is the case, he's going to have issues as the ASA is an asshole when you try to do this.
 
berky said:
what ping's timeout? to the ASA? to the router? to the internet?

where are you plugged in? i don't see how you can have your inside router interface and your ASA inside interface in the same network.

I am imagining the setup something like this:

Internet --------- outside (router) inside ------------ outside (ASA) inside ------------------ laptop/PC

the network between the router and ASA needs to be different from that between the ASA and computer. Also, on the ASA, you have to enable the ability for it to respond to ICMP. I think it's something like "icmp <allowed network> <allowed network mask> <interface nameif>".... or something like that.

are you sure there's not another system that has 1.1 IP configured on it? I think we need more information on the layout.
Click to expand...

The ping from my PC (192.168.1.X) to the ASA (192.168.1.1) times out as SOON as I change the default gateway on my PC to the address of the ASA. So both the router and the asa are configured to go out to the internet (they have different public IP's assigned to them). I'm just trying to change the device I am trying to get to the internet with.

Also both devices have the same default route pointing to the gateway of the internet router.
 
jenuster said:
The ping from my PC (192.168.1.X) to the ASA (192.168.1.1) times out as SOON as I change the default gateway on my PC to the address of the ASA. So both the router and the asa are configured to go out to the internet (they have different public IP's assigned to them). I'm just trying to change the device I am trying to get to the internet with.

Also both devices have the same default route pointing to the gateway of the internet router.
Click to expand...

How long do you wait for the ping to come up?
 
Vito_Corleone said:
He says both devices are plugged into the same switch. So assuming that's true, and he doesn't have conflicting .1s, I don't see how it could be an ARP issue.

If I'm understanding it right (big if, at this point), it's a single subnet/broadcast domain, all three devices are connected to the same switch. He's got .3 (router) as his gateway and is pinging .1 (ASA). He then changes the gateway to .1 (ASA) and the ping dies. No idea why this is happening, and I don't think it's an ARP thing.

I'm not clear on how the ASA is connected to the internet, which is why I asked if its default route is pointing to the router. If this is the case, he's going to have issues as the ASA is an asshole when you try to do this.
Click to expand...

But he is possibly talking about his lab network. He might have his normal home network that has the same default GW. He could be taking the network cable on this PC from the home network to the lab network.
 
AMD_Gamer said:
But he is possibly talking about his lab network. He might have his normal home network that has the same default GW. He could be taking the network cable on this PC from the home network to the lab network.
Click to expand...

As of his last post, he's confirmed that he's not doing this. Not sure where you're making that jump either.
 
Vito - I wait a long time.

AMD_Gamer - My lab network is my home lab. I have the network cables plugged into the both devices.
 
jenuster said:
Vito - I wait a long time.

AMD_Gamer - My lab network is my home lab. I have the network cables plugged into the both devices.
Click to expand...

Ok next question.

Is this an ASA you got from ebay? have you cleared the running config?

Also you could possibly have a bad network cable.
 
jenuster said:
Vito - I wait a long time.
Click to expand...

Hmm. Well, you can do an arp -a before and after you move the DG. This will rule that out. Next, you can run a capture (Wireshark or something else) on the host to see what's going out. Last, I'd run a capture on the ASA to see what's coming in ("capture inside interface inside", then "sh capture inside" to see what's coming in"). Still not sure what could be going on.
 
AMD_Gamer said:
Ok next question.

Is this an ASA you got from ebay? have you cleared the running config?

Also you could possibly have a bad network cable.
Click to expand...

If it pings at all, why would it be a config issue? The source of the ping will be the same before and after he changes the DG. Same thing with the cable. If the ASA never replied to ping, I could see it being config or physical. Who knows though, this doesn't really make any sense.
 
Yeah I'm going to load up WireShark and see what's going. By the way, as soon as I remove the gateway of the PC from the ASA address to the router address, I get ping replies again.

Also, when I make the change of changing the gateway on the PC. NO devices on the network are able to ping 192.168.1.1.

This is an interesting one.

Update: I get a few ping replies back once I change the gateway (though most of the ping results time out (about 98%)
 
how many times have you tried switching back and forth? ask because maybe you accidently changed the mask when you were changing the dg
 
Enable some logging on the ASA and see if anything shows up.

What happens when you don't configure a gateway at all? Can you still ping the ASA? Nothing else being able to ping the ASA makes no sense at all.
 
this doesn't make sense at all.... the DG has NO bearing whatsoever on a directly connected network. what OS are you using? can you do a "route print" before and after the DG change and post it? also do a "arp -a" before and after DG change as well.
 
More info: From the ASA I can ping the PC without any packet loss.So it looks like the issue is when the host pings the ASA and the return traffic somehow gets lost.
 
jenuster said:
More info: From the ASA I can ping the PC without any packet loss.So it looks like the issue is when the host pings the ASA and the return traffic somehow gets lost.
Click to expand...

Makes no sense. A ping goes both ways. Run those captures.

Edit: Longshot, but is there a firewall on the host? This wouldn't explain all of it, but could account for some.
 
oh, another question.... what is the subnet mask you have on your PC, router, and ASA?

I'm betting maybe your subnet is borked up and your PC thinks the ASA IP isn't in the same network. so, i bet your pings work when your DG is the router because the router is forwarding the pings to the ASA and the ASA responds directly to you, but the with the DG of the ASA, your PC doesn't know how to get to its gateway since it's not technically directly connected.


just a theory.... :)
 
berky said:
oh, another question.... what is the subnet mask you have on your PC, router, and ASA?

I'm betting maybe your subnet is borked up and your PC thinks the ASA IP isn't in the same network. so, i bet your pings work when your DG is the router because the router is forwarding the pings to the ASA and the ASA responds directly to you, but the with the DG of the ASA, your PC doesn't know how to get to its gateway since it's not technically directly connected.


just a theory.... :)
Click to expand...

he said some were getting through.
 
berky said:
oh, another question.... what is the subnet mask you have on your PC, router, and ASA?

I'm betting maybe your subnet is borked up and your PC thinks the ASA IP isn't in the same network. so, i bet your pings work when your DG is the router because the router is forwarding the pings to the ASA and the ASA responds directly to you, but the with the DG of the ASA, your PC doesn't know how to get to its gateway since it's not technically directly connected.


just a theory.... :)
Click to expand...

Nice. That could be. Although, what mask would do that? .1 and .3 should always be on the same subnet other than a /31.

Edit: Also, if it works when he pings from the ASA and to the PC, this wouldn't fit.
 
hmm..good idea but all are devices are set to subnet mask of /24

I think the culprit is somehow the switch (I tried two different ASA's (don't judge)

The switch is a HP 1810g-24
 
jenuster said:
hmm..good idea but all are devices are set to subnet mask of /24

I think the culprit is somehow the switch (I tried two different ASA's (don't judge)

The switch is a HP 1810g-24
Click to expand...

Ok so reset the config to default settings.

Try different ports.
 
So I read your edit. You're saying some pings succeed when you change the DG, but it's 98% loss? Is it 0% loss when the DG is the router?
 
berky said:
oh, another question.... what is the subnet mask you have on your PC, router, and ASA?

I'm betting maybe your subnet is borked up and your PC thinks the ASA IP isn't in the same network. so, i bet your pings work when your DG is the router because the router is forwarding the pings to the ASA and the ASA responds directly to you, but the with the DG of the ASA, your PC doesn't know how to get to its gateway since it's not technically directly connected.


just a theory.... :)
Click to expand...

as i understand a router connects different networks (one network per interface). if the asa was on a different network due to the mask being wrong and it was the inside lan interface he would not be able to ping it at all even if the DG was pointing to the router.

I could be wrong tho and learn different as a advance further into networking.
 
AMD - These are ASA 5505's and not purchased from e-bay.

Vito - The arp cache stays the same before and after i changed the DG. Also, I tried clearing out the arp cache after I changed the DG.

When I did a capture before changing the DG, I saw the ICMP echo and echo-reply, as soon as I change the DG, the ASA is not receiving the echo packets at ALL.

There has to be an explanation to this.
 
What do you see on the host's capture? Is the frame going out? Does it have the right DMAC? Also, did you check the host's firewall settings?

Do you have another switch to test with? Some unmanaged DLink or something? How is the current switch configured?
 
move both the PC and the ASA to the switch ports farthest to the end of the switch.
 
You must log in or register to reply here.
Back
Top