Question : Cisco ASA 5200 - Subinterfaces with VLAN's.  Problem getting VLANS to communicate with one another.

Folks,

   I'm going a little nuts here trying to get two VLAN's configured on an ASA 5200 to talk with one another.  The purpose behind creating the two VLAN's is to use one for the physical servers and the second for the SAN which will be hosting the VMware data.  I'd like VLAN 20 to be able to NAT outside and have this functioning.  VLAN 10 should not be reachable from the outside, nor should it be able to reach outside it's VLAN.  VLAN 10 and 20 need to be able to communicate.

   The ASA is connected to a Cisco Catalyst Switch and the port that Gigabit0/1 is connected to is in trunking mode.  

   Config pasted below.  Help appreciated.

sh run
: Saved
:
ASA Version 7.0(5)
names
name 192.168.254.0 VMServers
name 10.100.100.0 DiskArray
dns-guard
!
interface GigabitEthernet0/0
 nameif outside
 security-level 0
 ip address 63.x.x.x255.255.x.x
!
interface GigabitEthernet0/1
 description Test
 nameif inside
 security-level 100
 no ip address
!
interface GigabitEthernet0/1.10
 description Disk Array Interface
 vlan 10
 nameif DiskArray
 security-level 100
 ip address 10.100.100.254 255.255.255.0
!
interface GigabitEthernet0/1.20
 description VMware Server interface
 vlan 20
 nameif VMServers
 security-level 100
 ip address 192.168.254.254 255.255.255.0
!
interface GigabitEthernet0/2
 shutdown
 no nameif
 no security-level
 no ip address
!
interface GigabitEthernet0/3
 shutdown
 no nameif
 no security-level
 no ip address
!
interface Management0/0
 nameif management
 security-level 100
 ip address 10.100.101.254 255.255.255.0
 management-only
!
passwd TzNUYI2PDdGCsxIZ encrypted
ftp mode passive
clock timezone CST -6
clock summer-time CDT recurring
same-security-traffic permit inter-interface
access-list Test extended permit ip any any
access-list Test extended permit icmp any any
pager lines 24
logging asdm informational
mtu management 1500
mtu outside 1500
mtu inside 1500
mtu DiskArray 1500
mtu VMServers 1500
no failover
asdm image disk0:/asdm505.bin
no asdm history enable
arp timeout 14400
global (outside) 50 interface
global (DiskArray) 20 interface
global (VMServers) 10 interface
nat (DiskArray) 10 VMServers 255.255.255.0
nat (VMServers) 20 DiskArray 255.255.255.0
nat (VMServers) 50 0.0.0.0 0.0.0.0
access-group Test in interface inside
route outside 0.0.0.0 0.0.0.0 63.76.89.193 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00
timeout mgcp-pat 0:05:00 sip 0:30:00 sip_media 0:02:00
timeout uauth 0:05:00 absolute
http server enable
http 10.100.101.0 255.255.255.0 management
http DiskArray 255.255.255.0 DiskArray
http VMServers 255.255.255.0 VMServers
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet VMServers 255.255.255.0 management
telnet 0.0.0.0 0.0.0.0 outside
telnet timeout 5
ssh 0.0.0.0 0.0.0.0 outside
ssh 0.0.0.0 0.0.0.0 inside
ssh 0.0.0.0 0.0.0.0 VMServers
ssh timeout 5
console timeout 30
dhcpd address 10.100.101.100-10.100.101.150 management
dhcpd lease 3600
dhcpd ping_timeout 50
dhcpd enable management
!
class-map inspection_default
 match default-inspection-traffic
!
!
policy-map global_policy
 class inspection_default
  inspect dns maximum-length 512
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
Cryptochecksum:fbb9e0e4dc59c05224041c45df58e7cb
: end


TIA!

Answer : Cisco ASA 5200 - Subinterfaces with VLAN's.  Problem getting VLANS to communicate with one another.

Have you tried this?

access-list nonat permit ip DiskArray 255.255.255.0 VMServers 255.255.255.0
access-list nonat permit ip VMServers 255.255.255.0 DiskArray 255.255.255.0


nat (inside) 0 access-list nonat

DC