Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to replace a 1700 Cisco router with a Cisco Asa 5520 firewall version 7. Before I make the switch, I want to be sure everything is working properly. I'm open to all suggestions.

What i need the most is;

  1. Allow traffic or communication from all inside users to the Outside (internet)
  2. Allow inside users access to the DMZ
  3. Allow outside internet users to access my DMZ
  4. Allow DMZ to access the outside.

My LAN Setup:

Internet cloud=1 parameter or internet router=Cisco Asa 5520 FW V7= then one connection the Inside network and the other to the DMZ

ASA-FW (config)#interface GigabitEthernet0/0
ASA-FW (config)#nameif outside
ASA-FW (config)#security level 0
ASA-FW (config)# ip address 41.223.156.109 255.255.255.248
description "Link-To-GW-Router"
no sh
exit


ASA-FW (config)# interface GigabitEthernet0/1
ASA-FW (config)#nameif inside
ASA-FW (config)#security level 100
ASA-FW (config)#ip address 10.1.4.1 255.255.252.0
description "Link-To-Local-LAN"
no shutdown
exit



ASA-FW (config)# interface gigabitEthernet 0/2
ASA-FW (config)#nameif DMZ
ASA-FW (config)#security level 50
ASA-FW (config)#ip address 172.16.16.1 255.255.255.0
description "Link-To-DMZ"
ASA-FW (config)#no sh
Exit

Senario 1 Implementing Route

ASA-FW (config)# route outside 0.0.0.0 0.0.0.0  41.223.156.109              “default route”
ASA-FW (config)# route inside 10.1.4.0 255.255.255.0 41.223.156.109  “static route”

Note: even though static router wont be needed since the inside interface is directly connected to the inside switch

Senario 2 NAT Configuration PAT

ASA-FW(config)#nat(inside)1 10.1.4.0 255.255.252.0    the inside sub to use Pat 
ASA-FW(config)#global(outside)1 100.1.1.2 netmask 255.255.255.0  using a single global IP add for Pat

Senario 3. STATIC NAT AND ACL- ALLOW INBOUND ACCESS TO THE DMZ SERVICES

ciscoasa(config)# static (DMZ , outside) 100.1.1.1 10.0.0.1 netmask 255.255.255.255 ciscoasa(config)# static (DMZ , outside) 100.1.1.2 10.0.0.2 netmask 255.255.255.255 ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp any host 100.1.1.1 eq 80 ciscoasa(config)# access-list OUTSIDE-IN extended permit tcp any host 100.1.1.2 eq 25 ciscoasa(config)# access-group OUTSIDE-IN in interface outside 
ciscoasa(config)# access-list DMZ-IN extended deny ip any any log
ciscoasa(config)# access-group DMZ-IN in interface DMZ

Scenario 4: Apply Outbound Restrictions from Inside to DMZ

Now, here i assume that users on the Inside network (10.1.4.0) are only allowed to access the email Server at port 25 on the DMZ (to retrieve email) but should not have any access to the rest of the DMZ network. All access however towards the Internet should be allowed.

ciscoasa(config)# access-list INSIDE-IN extended permit tcp 10.1.4.0 255.255.252.0 host 172.16.16.25 eq 25 
ciscoasa(config)# access-list INSIDE-IN extended deny ip 10.1.4.0 255.255.252.0 10.0.0.0 255.255.255.0
 ciscoasa(config)# access-list INSIDE-IN extended permit ip 10.1.4.0 255.255.252.0 any ciscoasa(config)# access-group INSIDE-IN in interface inside 
ciscoasa(config)# access-list NO-NAT extended permit ip 10.1.4.0 255.255.252.0 172.16.16.1 255.255.255.0 
ciscoasa(config)# nat (inside) 0 access-list NO-NAT
 ciscoasa(config)# nat (inside) 1 10.1.4.0 255.255.252.0
ciscoasa(config)# global (outside) 1 interface

Senario 5 Create static NAT of inside network towards the DMZ

#static (inside,DMZ) 10.1.4.0 172.16.16.0 netmask 255.255.255.0

With this configuratin above, can anyone please confirm to me and correct me if this configuration will WORK? OR NOT? am i OK? anything else i need to to? anything that i should remove?

Let me thank you in advance for your time and cooperation already.

BIG DENZEL

share|improve this question
    
More often than not, people post specific examples of things that aren't working with their current configs. You're asking someone to help you configure your entire network, as far as I can tell. There is a lot of information on how to configure your ASA for basic ingress/egress. Have you searched for any of that? Do computers on the inside have access out? –  GregD Apr 3 '11 at 18:38
1  
Also if by "Version 7" of the ASA you mean some variant of version 7 of the ASA software, then I'd start by upgrading the ASA to (as of this writing) 8.4(x) of the software. –  GregD Apr 3 '11 at 19:16
    
@GregD is correct, this is really too broad. That said, your routing config is wrong; the outside route should be pointed to your next-hop gateway, not the ASA's outside address. Likewise, the inside static route would typically point to an inside router for internal subnets that aren't directly connected. Get rid of that command, it will probably break stuff. –  Shane Madden Apr 3 '11 at 19:24
    
alright Shane and GregD, thanx alot for your comment...but as i said im new to configure a Asa thats y i need help, it might look to much, but thats my reality n here im just being honest t myself. –  Big Denzel Apr 4 '11 at 4:35
    
by the way Shane, as for routing as you said; how then my routing should look like??any idea or help please? On the other side How about the rest of the configuration? please help and thanks alot for ur comment guys... i really appretiate it –  Big Denzel Apr 4 '11 at 4:38

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Browse other questions tagged or ask your own question.