Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I need a little help in developing a config for our ASA5505. I'm an MCSA/MCITPAS but I don't have a lot of practical cisco experience.

Here is what I need help with, we currently have a PIX as our border gateway and, well, it's antiquated and only has a 50-user license which means I'm constantly clearing local-host throughout the day as people complain. I discovered that the last IT person bought a couple ASA5505's and they've been sitting in the back of a cupboard.

So far I've duplicated the configuration from the PIX to the ASA but I thought I'd go further and remove another old Cisco router that is used only for a guest network. I know the ASA can do both jobs.

So I'm going to paste a scenario I wrote up with the actual IPs changed to protect the innocent.

...

Outside Network: 1.2.3.10 255.255.255.248 (we have a /29)
Inside Network: 10.10.36.0 255.255.252.0
DMZ Network: 192.168.15.0 255.255.255.0

Outside Network on e0/0
DMZ Network on e0/1
Inside Network on e0/2-7

DMZ Network has DHCPD Enabled.
DMZ DHCPD Pool is 192.168.15.50-192.168.15.250
DMZ Network needs to be able to see DNS on Inside Network at 10.10.37.11 and 10.10.37.12
DMZ Network needs to be able to access webmail on inside network at 10.10.37.15
DMZ Network needs to be able to access business website on inside network at 10.10.37.17
DMZ Network needs to be able to access the outside network (access to the internet).

Inside Network has NO DHCPD. (dhcp is handled by domain controller)
Inside Network needs to be able to see anything on the DMZ network.
Inside Network needs to be able to access the outside network (access to the internet).

There are some access-list already, and some static NAT mapping in place already.

Maps external IPs from our ISP to our inside server IPs

 static (inside,outside) 1.2.3.11 10.10.37.15 netmask 255.255.255.255
 static (inside,outside) 1.2.3.12 10.10.37.17 netmask 255.255.255.255
 static (inside,outside) 1.2.3.13 10.10.37.20 netmask 255.255.255.255

Allows access to our Webserver/Mailserver/VPN from the Outside.

 access-list 108 permit tcp any host 1.2.3.11 eq https
 access-list 108 permit tcp any host 1.2.3.11 eq smtp
 access-list 108 permit tcp any host 1.2.3.11 eq 993
 access-list 108 permit tcp any host 1.2.3.11 eq 465
 access-list 108 permit tcp any host 1.2.3.12 eq www
 access-list 108 permit tcp any host 1.2.3.12 eq https
 access-list 108 permit tcp any host 1.2.3.13 eq pptp

Here is all the NAT and route stuff I have so far.

 global (outside) 1 interface
 global (outside) 2 1.2.3.11-1.2.3.14 netmask 255.255.255.248
 nat (inside) 1 0.0.0.0 0.0.0.0
 nat (dmz) 1 0.0.0.0 0.0.0.0

 route outside 0.0.0.0 0.0.0.0 1.2.3.9 1
share|improve this question
1  
What exactly is your question? –  200_success Dec 7 '12 at 1:15
    
I need to add the DMZ as the guest network to a config. how do I do the routing so that in the scenario I posted, it should work properly? the biggest question I didn't know how to set the DMZ's DHCP DNS to see the inside networks DNS servers. is that possible? or do I need a DNS server on the DMZ network? –  GriffJ Dec 7 '12 at 10:42

1 Answer 1

up vote 0 down vote accepted

you don't mention what version you are running but judging by your NAT commands its 8.2 or below. I have some sample config that should get DHCP working on the DMZ and access from the DMZ to your LAN DNS, internal websites and web access to the internet. You can probably use it as a guide to add more if needed. You wont need to change the routing as these are all directly connected networks.

This should be all you need for the DHCP config

dhcpd dns 10.10.37.11 10.10.37.12
dhcpd domain example.com
dhcpd address 192.168.15.50-192.168.15.250 DMZ
dhcpd enable DMZ

An access list permitting traffic arriving at the DMZ interface. including your DNS traffic to the LAN

access-list DMZ-Access_in extended permit UDP any host 192.168.15.50 eq 53
access-list DMZ-Access_in extended permit UDP any host 192.168.15.250 eq 53
access-list DMZ-Access_in extended permit TCP any host 10.10.37.15 eq 443
access-list DMZ-Access_in extended permit TCP any host 10.10.37.15 eq 80
access-list DMZ-Access_in extended permit TCP any host 10.10.37.17 eq 443
access-list DMZ-Access_in extended permit TCP any host 10.10.37.17 eq 80
access-list DMZ-Access_in extended permit TCP any any eq 80
access-list DMZ-Access_in extended permit TCP any any eq 443

Apply the access list to the DMZ interface.

access-group DMZ-Access_in in interface DMZ

Also Check that you have a security plus licence as on the 5505 the DMZ is restricted without

Show version

Edit:

To answer your questions: with the base licence you will not be able to do what you want. The restricted dmz means you have to pick a vlan that the dmz cannot speak to. It can be either the Lan or outside.

Yes the inside outside and dmz would count as three vlans, the 5505 operates like a layer 3 switch with vlans being applied to switch ports. All the other asa's use layer 3 routed ports where you can divide them up into sub interfaces and connect trunks to them.

Sec plus costs a bit but is worth it to move from a pix to asa. The asa is much better and has a pretty good gui that will allow you to easily make changes.

share|improve this answer
    
Sorry yes, it is ASA version 8.2. I forget that the command lines change from version to version.. show ver says "VLANS: 3, DMZ Restricted." and "This platform has a Base license." I just bought an installed an unlimited hosts license. Will I still be able to use DMZ as a guest network with this device? –  GriffJ Dec 7 '12 at 16:48
    
Also if I can't use the DMZ, it says it supports 3 Vlans. could I not just define another vlan with security-level 50, on a specified interface? if the DMZ can't be used as the guest network? or does the Inside Outside and DMZ always count as the 3 vlans, and I can't define more. –  GriffJ Dec 7 '12 at 16:58
    
Wow 500+ bucks for a L-ASA5505-SEC-PL= .. If using DMZ like this isn't possible with my current ASA5505 I'll just continue to use the separate cisco router for the guest network. –  GriffJ Dec 7 '12 at 17:17

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.