I'm trying to set up a Cisco ASA 5520 as the main entry point for our datacenter setup. This setup includes:
- Three private networks (management, SAN and backup) that are used in a cloud server configuration
- One publicly accessible /26 subnet, both used for customer servers and the cloud server configuration
So the networks are defined as:
Subnet 18.104.22.168/26 ISP Gateway 22.214.171.124 Management 10.10.10.0/24 SAN 10.20.20.0/24 Backup 10.30.30.0/24
There are currently some customer servers already online, using a Catalyst 3548XL to connect them to the internet. The current situation looks like this:
ISP Uplink ---> Cisco Catalyst 3548XL |--> Customer servers on /26 subnet, using ISP gateway |--> Cisco ASA 5520 (126.96.36.199 on outside intf, routing to ISP gateway) |--> Management: 10.10.10.1 --> Dell 7024 Gigabit stack |--> SAN: 10.20.20.1 --> Dell 7024 Gigabit stack |--> Backup: 10.30.30.1 --> Dell 7024 Gigabit stack
What I'm trying to achieve is to place the Catalyst behind the ASA, so the ISP uplink is connected to the ASA and the /26 subnet is connected to an 'inside' port behind the ASA (What I think is a DMZ setup?). Preferably still using the ISP gateway (.65) as the internet gateway for the /26 subnet, so I won't have to contact my customers to update their network configurations. If I understand the documentation correctly this should only be possible using a transparent firewall setup, but as ASA doesn't support a mix of transparent and routed security contexts and I definately need a routed configuration for my private networks this should be hard to achieve. But please correct me if I'm wrong.
Currently the only solution seems to be to introduce the ASA as an additional hop, making it the gateway for the /26 subnet. I'm completely clueless how to set this up though, and I'm really hoping someone can give me some pointers on how to achieve this.
The desired setup would look like this:
ISP Uplink ---> Cisco ASA 5520 (188.8.131.52 on outside intf, routing to ISP gateway (.65) |--> Public subnet (Don't know what the IP config should be) | |--> Cisco Catalyst 3548XL | |--> Customer servers on /26 subnet (Gateway = ?) | |--> Cloud setup public connections (Gateway = ?) | |--> Management: 10.10.10.1 --> Dell 7024 Gigabit stack |--> SAN: 10.20.20.1 --> Dell 7024 Gigabit stack |--> Backup: 10.30.30.1 --> Dell 7024 Gigabit stack
I thought a solution would be to set the ASA outside to
184.108.40.206 with netmask
255.255.255.252, and the public inside interface to
220.127.116.11 with the rest of the /26 subnet, but the ASA won't let me do this as the subnets would overlap, so now I'm stuck!