We have a small business office, but due to PCI compliance we need to segment this into two internet networks (one 'compliant' and one for any other devices to use).
We currently have a Draytek modem/wan load balancer which also has firewalling but this is very basic and doesn't support seperate security policies on each vlan.
As such, I have just purchased an ASA 5505 and would like some pointers to setting things up:
- Outside (draytek)
- InsidePci (our secure zone, contains a windows domain controler/dhcp/etc)
- Inside (just a regular network that just has internet access and no connection to vlan
At the moment everything is on one subnet 192.168.2.x. The draytek has a static IP and everything else is allocated an IP from our Windows DHCP Server. As this windows server will be within the 'insidepci' network I was planning to have this vlan continue to use that, and the regular 'inside' network using DHCP from the ASA. Is that possible?
Do I need to put the draytek on it's own subnet (so just the draytek is on say 192.168.3.x) as it seems I cant allocate an IP in the same range to two different VLANs.
From looking at one of the online guides, it seems I would then need an internal router? I wasn't aware of this, I was hoping I could just assign one switch to the 'inside' VLAN and a seperate switch to the 'insidepci' vlan? There isn't a need to communicate between these VLANS but both need to be able to access 'outside' (draytek gateway)