I need to replace a 1700 Cisco router with a Cisco Asa 5520 firewall version 7. Before I make the switch, I want to be sure everything is working properly. I'm open to all suggestions.
What i need the most is;
- Allow traffic or communication from all inside users to the Outside (internet)
- Allow inside users access to the DMZ
- Allow outside internet users to access my DMZ
- Allow DMZ to access the outside.
My LAN Setup:
Internet cloud=1 parameter or internet router=Cisco Asa 5520 FW V7= then one connection the Inside network and the other to the DMZ
ASA-FW (config)#interface GigabitEthernet0/0
ASA-FW (config)#nameif outside
ASA-FW (config)#security level 0
ASA-FW (config)# ip address 41.223.156.109 255.255.255.248
description "Link-To-GW-Router"
no sh
exit
ASA-FW (config)# interface GigabitEthernet0/1
ASA-FW (config)#nameif inside
ASA-FW (config)#security level 100
ASA-FW (config)#ip address 10.1.4.1 255.255.252.0
description "Link-To-Local-LAN"
no shutdown
exit
ASA-FW (config)# interface gigabitEthernet 0/2
ASA-FW (config)#nameif DMZ
ASA-FW (config)#security level 50
ASA-FW (config)#ip address 172.16.16.1 255.255.255.0
description "Link-To-DMZ"
ASA-FW (config)#no sh
Exit
Senario 1 Implementing Route
ASA-FW (config)# route outside 0.0.0.0 0.0.0.0 41.223.156.109 “default route”
ASA-FW (config)# route inside 10.1.4.0 255.255.255.0 41.223.156.109 “static route”
Note: even though static router wont be needed since the inside interface is directly connected to the inside switch
Senario 2 NAT Configuration PAT
ASA-FW(config)#nat(inside)1 10.1.4.0 255.255.252.0 the inside sub to use Pat
ASA-FW(config)#global(outside)1 100.1.1.2 netmask 255.255.255.0 using a single global IP add for Pat
Senario 3. STATIC NAT AND ACL- ALLOW INBOUND ACCESS TO THE DMZ SERVICES
ciscoasa(config)# static (DMZ , outside) 100.1.1.1 10.0.0.1 netmask 255.255.255.255 ciscoasa(config)# static (DMZ , outside) 100.1.1.2 10.0.0.2 netmask 255.255.255.255 ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp any host 100.1.1.1 eq 80 ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp any host 100.1.1.2 eq 25 ciscoasa(config)# access-group OUTSIDE-IN in interface outside
ciscoasa(config)# access-list DMZ-IN extended deny ip any any log
ciscoasa(config)# access-group DMZ-IN in interface DMZ
Scenario 4: Apply Outbound Restrictions from Inside to DMZ
Now, here i assume that users on the Inside network (10.1.4.0) are only allowed to access the email Server at port 25 on the DMZ (to retrieve email) but should not have any access to the rest of the DMZ network. All access however towards the Internet should be allowed.
ciscoasa(config)# access-list INSIDE-IN extended permit tcp 10.1.4.0 255.255.252.0 host 172.16.16.25 eq 25
ciscoasa(config)# access-list INSIDE-IN extended deny ip 10.1.4.0 255.255.252.0 10.0.0.0 255.255.255.0
ciscoasa(config)# access-list INSIDE-IN extended permit ip 10.1.4.0 255.255.252.0 any ciscoasa(config)# access-group INSIDE-IN in interface inside
ciscoasa(config)# access-list NO-NAT extended permit ip 10.1.4.0 255.255.252.0 172.16.16.1 255.255.255.0
ciscoasa(config)# nat (inside) 0 access-list NO-NAT
ciscoasa(config)# nat (inside) 1 10.1.4.0 255.255.252.0
ciscoasa(config)# global (outside) 1 interface
Senario 5 Create static NAT of inside network towards the DMZ
#static (inside,DMZ) 10.1.4.0 172.16.16.0 netmask 255.255.255.0
With this configuratin above, can anyone please confirm to me and correct me if this configuration will WORK? OR NOT? am i OK? anything else i need to to? anything that i should remove?
Let me thank you in advance for your time and cooperation already.
BIG DENZEL
