Configuring Interfaces and Routing with Cisco ASA 5505

Hello All,

I've been working more closely with the Cisco ASA 5505 device as of late and starting to get more hands on for overall knowledge of the device...I was hoping a someone can help me with configuring/explaining interfaces and simple routing with the ASA 5505.

Basically, my network has 2 vlans configured by a Dlink Switch.  One Vlan is used for voip and the other is the company network.

I was wondering with my ASA 5505, could i configure it to route traffic between the 2 vlans?

on my ASA, Vlan 1 is used for Inside network and Vlan 2 is used for Outside...I was hoping to configure another interface with the ip address/subnet of the VOIP vlan and have traffic routed back and forth.

is this a viable solution or do i need a real router in between?
LVL 1
jetli87Asked:
Who is Participating?

Improve company productivity with a Business Account.Sign Up

x
 
Cyclops3590Connect With a Mentor Commented:
switch needs to of course have the port trunked and configured to process the vlans (not sure how to configure dlink)

ASA:
1) like I said, just configure the voip sub-interface on the physical port.  This auto-trunks that physical port.
2) after you assign the correct vlan tag on the interface, the asa can now process that vlan's data
3) now you have to create a global/nat combination  so the voip network can communicate to the internet.  then for communication between the voip and inside networks, you'll create a static entry (easiest method for inter-interface transformation config)
4) also, you need to configure an acl and assign it to the voip interface defining which traffic is allowed.  however, if you wish, you can assign it the same security-level of the inside interface and then just ensure the ASA is configure for inter-interface communication
0
 
Cyclops3590Commented:
the asa can do it.  you just need to create the virtual interfaces, assign the appropriate vlan tag, security level, etc.  then just create the acls and static or global/nat entries to allow traffic to traverse the interfaces.

example


int eth0/0.10
  vlan 10
  nameif voip
  security-level 75
  ip address .....

global (outside) 5 <ip address>
nat (voip) 5 0 0

that's just a rough example though

the asa does basic routing.  the main thing to remember about cisco firewalls though is they don't allow return path traffic.  meaning if a packet sent to the inside interface needs to go back out the inside interface, it is dropped.  This is because cisco firewalls are considered pure security devices and by allowing this kind of traffic an open the device up for certain types of attacks
0
 
Cyclops3590Commented:
however you said the outside connection is a vlan.  this should be on a separate interface of the asa.  partly for security so you don't have to worry about vlan attacks, but also because I believe the 5505 model only allows 2 vlans unless the security plus license is purchased
0
Prepare for an Exciting Career in Cybersecurity

Help prevent cyber-threats and provide solutions to safeguard our global digital economy. Earn your MS in Cybersecurity. WGU’s MSCSIA degree program curriculum features two internationally recognized certifications from the EC-Council at no additional time or cost.

 
jetli87Author Commented:
understood...so in this situation:

1 Dlink 48 Port Switch with 2 Vlan, 1) VOIP: 10.20.111.0/255.255.255.0  & 2) LAN: 10.20.100.0/255.255.255.0  

Cisco ASA 5505: 10.20.100.1 Connected directly to 10.20.100.0/255.255.255.0  Vlan port.

what is the best way to get devices on both Vlans to communicate each other and for the 10.20.111.0/255.255.255.0 network to reach the internet if need be?

0
 
jetli87Author Commented:
Thanks Cyclops, i'll test out the config this weekend and get back to you.

until then, enjoy!
0
 
etonnemacherCommented:
Hey cyclops - the asa 5505 doesn't do virtual interfaces does it?
0
 
Cyclops3590Commented:
yes, but how many depends on the license you have; base or security plus
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.