1

I have a problem configuring a Cisco ASA 5505 in that client workstations from our inside LAN can't access the internet through the ASA. I'm trying to implement it within a business network behind a Cisco WAG320N router:

ISP >> WAG320N >> ASA5505 >> Switch >> LAN Network.

I've configured the ASA like this:

vLan2 - outside - 
ip address xx.xxx.xxx.23 (this is our static IP) net mask 255.255.255.0
security-level 0.

vLan1 - inside  - 
ip address 192.168.1.1 net mask 255.255.255.0
security-level 100.

dhcpd address 192.168.1.5-192.168.1.120 inside

global (outside) 1 interface
nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 81.xx.xx.xx 1 (ISP gateway).

I'm guessing that I have to set my router (WAG320N) into bridge mode, or do a static NAT on the router to point to the ASA; but I'm not sure.

Any help would be greatly appreciated as I'm not even sure that my ASA config is correct.

Improve this question
2
  • so this ASA is behind a Cisco WAG320N router, and the WAG320N is connected to the Internet? Maybe the next hop needs to be the Cisco WAG320N interface then? Would the ASA be assigned a public IP if it is the WAG320N that is connected to the Internet?
    – j_bombay
    Dec 13, 2012 at 19:34
  • Well the outside interface on the ASA has the public ip assigned to it at the mo.
    – Richard Allsopp
    Dec 13, 2012 at 21:01

2 Answers 2

Reset to default
0

As I understand your setup the ASA should have the public IP address and should function as your router ?

If you do so you don't need the WAG320N. you can just directly attach the ISP connection to your ASA I suppose,

Unless your connection is an ADSL / SERIAL connection and your asa doesn't have these ports. you should setup the WAG320N and use a /30 subnet between your ASA and WAG320N.

Improve this answer
5
  • Thanks for your reply - the ASA (or at least mine) doesn't have an RJ11 connection so I need the router as a bridge between the ISP and the ASA - also my connection requires a username and password and as I have a static IP don't think I can get the settings from the ISP via DHCP on the ASA. It has me stumped I must say.
    – Richard Allsopp
    Dec 13, 2012 at 18:49
  • Ok, I suppose you have 2 options:
    – MrLightBulp
    Dec 13, 2012 at 18:52
  • I'm guessing you mean: Bridge the router, or NAT within?
    – Richard Allsopp
    Dec 13, 2012 at 18:58
  • The problem with that is, there is no section for adding your username and password in bridged mode, and I'm unsure on the NAT command on the router.
    – Richard Allsopp
    Dec 13, 2012 at 19:00
  • I'm not so sure if bridging is possible on the WAN side, some provider (like mine) somehow do not allow switching on wan level
    – MrLightBulp
    Dec 13, 2012 at 19:06
0

I suppose you have 2 options:

option 1: port forwarding:

you could setup the WAG320N as your WAN router, and just forward a range of ports or specific ports (extra security level) here's a link! with an example

option 2: Directly Connect ASA buy card

Directly connect your ASA to the internet by buying a ADSL / Serial port card to put in your asa system.

Improve this answer
12
  • Don't forget to put a /30 network subnet between your router and asa
    – MrLightBulp
    Dec 13, 2012 at 19:06
  • I think I understand what you're saying, could you just explain how that would fix the issue? I'm not sure on the correct port range that would fix my problem.
    – Richard Allsopp
    Dec 13, 2012 at 19:16
  • So: public ip goes on wan side of your WAG320N, you create a /30 ip range (this gives you 2 configurable IP addresses nothing more) you put these between asa and WAG320N and on your asa you'll put a default route back to WAG320N, on the WAG320N you'll have to port forward all the ports you want to be forwarded (for example for a webserver inside your network to be accessible from the outside with the public ip addres you'll have to forward port 80 )
    – MrLightBulp
    Dec 13, 2012 at 19:23
  • Ok I see what you're saying, the only problem I can see is that I don't think my router allows me to create IP ranges; or at least I don't now how to do it (or is that NATing). The public ip is on the router and forwarding the correct ports is fine, I'm just not sure on the ip range creation (within the router that is).
    – Richard Allsopp
    Dec 13, 2012 at 19:32
  • You realy should be able to as it should be a private ip address. could you post a screenshot of your setup page ? I could assist you
    – MrLightBulp
    Dec 13, 2012 at 19:34

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .