0

I am using a Cisco ASA 5505, and my license only permits 2 interfaces, so I have just added a vlan instead. I want to keep this vlan away from the inside network. I believe it's something to do with the NATing, or nat exempt setup.I now have outside, inside and my new interface.

  • Yes, it's possible for both to use the internet connection while not being allowed to communicate with each other. What's your config look like, and which software version are you on? – Shane Madden Sep 18 '12 at 3:26
  • Hi Shane, I'm on ASA Version 8.2(1) – Samwise Sep 18 '12 at 7:30
  • I have moved over to an ASA5505 now, and my license only permits 2 interfaces, so I have just added a vlan instead. I believe it's something to do with the NATing, or nat exempt setup. – Samwise Sep 18 '12 at 11:17
  • When they say two interfaces, they mean VLANs, not the physical interfaces on the ASA. You can assign the 8 ports across your VLANs as you see fit, although you should probably stick to convention with port 0 assigned to outside, but the rest you can divide between an additional two VLANs (typically inside and dmz). – dunxd Sep 22 '12 at 23:57
1

It is now working. I had to add these lines to the config:

nat (DMZ) 0 access-list DMZ_nat0_outbound
nat (DMZ) 1 0.0.0.0 0.0.0.0
access-group DMZ_access_in in interface DMZ
| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.