Advertisement
- Home
- Hardware
- Networking Hardware
- Firewalls
- Basic NAT/Access List setup for 3-leg network
Advertisement
- 1. batry_boy 260,200
- 2. lrmoore 134,250
- 3. dpk_wal 120,277
- 4. RobWill 55,861
- 5. harbor235 53,278
- 6. rsivanandan 47,275
- 7. JFrederic... 47,125
- 8. Cyclops3... 44,576
- 9. Voltz-dk 43,350
- 10. naughton 34,880
- 11. MrHusy 34,000
- 12. from_exp 28,885
- 13. ck459 24,625
- 14. donjohnston 23,750
- 15. mabutterfi... 22,400
- 16. mkielar 21,519
- 17. stuknhaw... 21,000
- 18. arnold 20,626
- 19. PeteLong 19,800
- 20. giltjr 17,710
- 21. Nothing_... 15,000
- 22. mwecom... 14,305
- 23. feptias 14,270
- 24. keith_ala... 13,625
- 25. _jesper_ 13,475
- 1. lrmoore 1,090,122
- 2. batry_boy 451,429
- 3. RobWill 379,360
- 4. rsivanandan 248,294
- 5. dpk_wal 183,277
- 6. JFrederic... 135,044
- 7. harbor235 126,394
- 8. grblades 118,615
- 9. pseudocy... 90,643
- 10. Cyclops3... 89,604
- 11. nodisco 87,022
- 12. PeteLong 81,631
- 13. calvinetter 76,413
- 14. giltjr 71,445
- 15. Freya28 67,550
- 16. Joesmail 65,623
- 17. MrHusy 61,827
- 18. Voltz-dk 60,408
- 19. plemieux72 59,794
- 20. RPPreacher 56,866
- 21. sciwriter 56,400
- 22. naveedb 56,350
- 23. keith_ala... 55,849
- 24. Frabble 49,747
- 25. budchawla 47,364
| 03.04.2008 at 10:13AM PST, ID: 23213476 |
|
[x]
Attachment Details
|
||
Basic NAT/Access List setup for 3-leg network
Asked by juggernaughty in Networking Hardware Firewalls, Cisco PIX Firewall
Tags: cisco, asa, 5505, security plus license
Experts,
I need help configuring an ASA 5505 with a security plus license.I have split up the interfaces between three VLANs (Internal), (external), (DMZ). I am new to Cisco so please be verbose. Below I have a list of requirements and also a list of questions pertaining to them.
Specs:
ASA Version: 7.2(3)
ASDM Version: 5.2(3)
Firewall Mode: Routed
Context Mode: Single
In the Attached Picture is the network number scheme that will be used.
Configuration Requirements:
- (Internal) clients need to be able to communicate with devices on the Internet.
- (Internal) clients need to be able to communicate with some (DMZ) clients.
- (External) clients need to be able to communicate with (DMZ) servers.
** - Down the road I want to be able to remotely VPN into the ASA.
Questions:
1. What do I need to configure to allow (internal) resources to access (DMZ) resources? Since all interfaces are a part of the ASA do I need to do any type of routing for the two to talk to each other?
2. What kind of access lists will need to be created for question 1.? Can you give me an example using the attached picture?
3. Configuring NAT: The device came pre-configured so that (internal) resources could access (outside) resources using dynamic NAT. The rule looks like this:
Real address: interface inside, IP address: 0.0.0.0, Netmask: 0.0.0.0
Dynamic Translation: interface: outside
-->What does all 0's mean in the IP and netmask?
4. Should I use static NAT with PAT if I want (external) resources to access specific (DMZ) resources over a specified port?
5. Pertaining to question 4., if I use PAT will the ASA drop any (external) incoming traffic that is not specified for a configured port? For example, if I have a web server and an SMTP spam filter device in the (DMZ) will the ASA only allow traffic that is defined for ports 25 and 80\443 from (external) interface?
Thank you in advance for your time and effort.
Start Free Trial
I need help configuring an ASA 5505 with a security plus license.I have split up the interfaces between three VLANs (Internal), (external), (DMZ). I am new to Cisco so please be verbose. Below I have a list of requirements and also a list of questions pertaining to them.
Specs:
ASA Version: 7.2(3)
ASDM Version: 5.2(3)
Firewall Mode: Routed
Context Mode: Single
In the Attached Picture is the network number scheme that will be used.
Configuration Requirements:
- (Internal) clients need to be able to communicate with devices on the Internet.
- (Internal) clients need to be able to communicate with some (DMZ) clients.
- (External) clients need to be able to communicate with (DMZ) servers.
** - Down the road I want to be able to remotely VPN into the ASA.
Questions:
1. What do I need to configure to allow (internal) resources to access (DMZ) resources? Since all interfaces are a part of the ASA do I need to do any type of routing for the two to talk to each other?
2. What kind of access lists will need to be created for question 1.? Can you give me an example using the attached picture?
3. Configuring NAT: The device came pre-configured so that (internal) resources could access (outside) resources using dynamic NAT. The rule looks like this:
Real address: interface inside, IP address: 0.0.0.0, Netmask: 0.0.0.0
Dynamic Translation: interface: outside
-->What does all 0's mean in the IP and netmask?
4. Should I use static NAT with PAT if I want (external) resources to access specific (DMZ) resources over a specified port?
5. Pertaining to question 4., if I use PAT will the ASA drop any (external) incoming traffic that is not specified for a configured port? For example, if I have a web server and an SMTP spam filter device in the (DMZ) will the ASA only allow traffic that is defined for ports 25 and 80\443 from (external) interface?
Thank you in advance for your time and effort.
Start Free Trial
Attachments:
Loading Advertisement...
20080716-EE-VQP-32 / EE_QW_2_20070628
