Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am using a Cisco ASA 5505, and my license only permits 2 interfaces, so I have just added a vlan instead. I want to keep this vlan away from the inside network. I believe it's something to do with the NATing, or nat exempt setup.I now have outside, inside and my new interface.

share|improve this question
    
Yes, it's possible for both to use the internet connection while not being allowed to communicate with each other. What's your config look like, and which software version are you on? –  Shane Madden Sep 18 '12 at 3:26
    
Hi Shane, I'm on ASA Version 8.2(1) –  Samwise Sep 18 '12 at 7:30
    
I have moved over to an ASA5505 now, and my license only permits 2 interfaces, so I have just added a vlan instead. I believe it's something to do with the NATing, or nat exempt setup. –  Samwise Sep 18 '12 at 11:17
    
When they say two interfaces, they mean VLANs, not the physical interfaces on the ASA. You can assign the 8 ports across your VLANs as you see fit, although you should probably stick to convention with port 0 assigned to outside, but the rest you can divide between an additional two VLANs (typically inside and dmz). –  dunxd Sep 22 '12 at 23:57
add comment

1 Answer

It is now working. I had to add these lines to the config:

nat (DMZ) 0 access-list DMZ_nat0_outbound
nat (DMZ) 1 0.0.0.0 0.0.0.0
access-group DMZ_access_in in interface DMZ
share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.