Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Short version is we cannot communicate between our subnets.

We have a Cisco ASA 5505 we are using for our network router. We have a Netgear L2 switch behind that with 10 vlans. Each VLAN is on its own subnet. (10.0.10.x/24, 10.0.11.x/24, etc)

So ASA >>> Switch >>> Hosts

We have PAT for each subnet to our outside interface. Each subnet NATs out properly.

I have NAT exemption enabled for 2 of the subnets (eventually I will need all, but am just testing at the moment).

Config is here:

I have tried multiple ways for the NAT exemption to allow all traffic from our inside VLANS. At this point in time I am trying to get "Engineering" to communicate with all hosts on "AuthUser".

I can ping some hosts, but not as many as if I am directly on the interface. I can reach a port 80 service, but not 443. I cannot access anything via hostname or NetBIOS.

What am I missing to allow higher security level interfaces to fully communicate with lower security level interfaces?


share|improve this question
Why route VLAN traffic through the ASA when you can route it through the layer 3 switch? – joeqwerty Dec 4 '12 at 23:31
Sorry, that was a typo, it is a layer 2 switch. – Brandon Bearden Dec 5 '12 at 16:51
Gotcha. Thanks for the clarification. – joeqwerty Dec 5 '12 at 18:04
up vote 1 down vote accepted

have a look at Cisco ASA 5540_outside to inside traffic NAT and Cisco ASA 5505 Voice/Data VLANs not pinging/routing i think this should solve your connection and ACL question.

Why you wan't use Netbios Name Resolution instead of DNS?

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.