0

I have a Question. We actually have a Cisco 1812 Router and we're Switching to an ASA 5512-X. The Problem is, the ASA 5512-X only has 6 Ports. The 1812, had 8. All in use.

We need to translate 3 Public IP Adresses into our Private IP Adresses for our Servers in the Building. We also need the other Ports. Our Situation now is, that the 3 IP Adresses are translated from the Router. But with the ASA we don't have enough Ports for this.

My Question is, can I "forward" those 3 IP Addresses from the ASA over the BLUE Port (in my Picture) to the Switch (I think i need Layer3 for this?!) and the Switch does the Translation?

The Translation should be: Public IP A comes in from the Internet to the ASA, get forwarded to the switch and the switch translates it to the correct private IP.

IsThisPossible?(Picture)

Improve this question

1 Answer 1

Reset to default
0

This is a typical beginning of each failure story in deploying ASA. Someone decides he needs ASA instead of the router and starts to use it like router. But ASA isn't quite a router, it's a security appliance. It's not intended to be used instead of the router, it's intended to be used with a router. The fact that it's capable of doing some of the router's tasks is blocking the entire view of many engineers.

The end of this downward spiral is mostly common: sooner or later comes the need of doing something with ASA what only router is capable of (like VTI tunnel, or any dynamic routing capable tunnel) and then comes a frustration.

Don't switch from router to ASA. Use them together.

Improve this answer
9
  • The funny thing is, another company which has done our network administration has given us this advice to use the ASA instead of our 1812. Our network isn't that big so i think they meant using an ASA without a Router should work. So where you said "The fact that it's capable of doing some of the router's tasks ..." - i think they meant, that those tasks which can the ASA do, be enough for our usage. But after I started a research by myself I got stuck by this Problem. We also have three AP connected direct to the router. I also dont want this with the new Hardware.
    – SystemCookie
    Jan 27, 2016 at 9:48
  • Thanks for your quick Reply! :) VTI Tunnel -> Is this the method i am searching for? Because i don't know how the method is called. Therefore i used word like forwading :D
    – SystemCookie
    Jan 27, 2016 at 9:48
  • Nope, VTI tunnel is definitely not the method you are looking for, it's just an example of the task that ASA is incapable of.
    – drookie
    Jan 27, 2016 at 11:09
  • dayum - sorry for my english (I'm austrian) and my dumb question. I am really new to this topic but i am very interested. Do you know how the method i am looking for is called ? It would make my researches more easier!
    – SystemCookie
    Jan 27, 2016 at 11:17
  • Yup, the method is called "place ASA between the router and WAN, as it's indeded to".
    – drookie
    Jan 27, 2016 at 12:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .