Solved

Configuring Interfaces and Routing with Cisco ASA 5505

Posted on 2007-11-28
7
2,675 Views
Last Modified: 2008-04-01
Hello All,

I've been working more closely with the Cisco ASA 5505 device as of late and starting to get more hands on for overall knowledge of the device...I was hoping a someone can help me with configuring/explaining interfaces and simple routing with the ASA 5505.

Basically, my network has 2 vlans configured by a Dlink Switch.  One Vlan is used for voip and the other is the company network.

I was wondering with my ASA 5505, could i configure it to route traffic between the 2 vlans?

on my ASA, Vlan 1 is used for Inside network and Vlan 2 is used for Outside...I was hoping to configure another interface with the ip address/subnet of the VOIP vlan and have traffic routed back and forth.

is this a viable solution or do i need a real router in between?
0
Comment
Question by:jetli87
  • 4
  • 2
7 Comments
 
LVL 25

Expert Comment

by:Cyclops3590
Comment Utility
the asa can do it.  you just need to create the virtual interfaces, assign the appropriate vlan tag, security level, etc.  then just create the acls and static or global/nat entries to allow traffic to traverse the interfaces.

example


int eth0/0.10
  vlan 10
  nameif voip
  security-level 75
  ip address .....

global (outside) 5 <ip address>
nat (voip) 5 0 0

that's just a rough example though

the asa does basic routing.  the main thing to remember about cisco firewalls though is they don't allow return path traffic.  meaning if a packet sent to the inside interface needs to go back out the inside interface, it is dropped.  This is because cisco firewalls are considered pure security devices and by allowing this kind of traffic an open the device up for certain types of attacks
0
 
LVL 25

Expert Comment

by:Cyclops3590
Comment Utility
however you said the outside connection is a vlan.  this should be on a separate interface of the asa.  partly for security so you don't have to worry about vlan attacks, but also because I believe the 5505 model only allows 2 vlans unless the security plus license is purchased
0
 
LVL 1

Author Comment

by:jetli87
Comment Utility
understood...so in this situation:

1 Dlink 48 Port Switch with 2 Vlan, 1) VOIP: 10.20.111.0/255.255.255.0  & 2) LAN: 10.20.100.0/255.255.255.0  

Cisco ASA 5505: 10.20.100.1 Connected directly to 10.20.100.0/255.255.255.0  Vlan port.

what is the best way to get devices on both Vlans to communicate each other and for the 10.20.111.0/255.255.255.0 network to reach the internet if need be?

0
Better Security Awareness With Threat Intelligence

See how one of the leading financial services organizations uses Recorded Future as part of a holistic threat intelligence program to promote security awareness and proactively and efficiently identify threats.

 
LVL 25

Accepted Solution

by:
Cyclops3590 earned 500 total points
Comment Utility
switch needs to of course have the port trunked and configured to process the vlans (not sure how to configure dlink)

ASA:
1) like I said, just configure the voip sub-interface on the physical port.  This auto-trunks that physical port.
2) after you assign the correct vlan tag on the interface, the asa can now process that vlan's data
3) now you have to create a global/nat combination  so the voip network can communicate to the internet.  then for communication between the voip and inside networks, you'll create a static entry (easiest method for inter-interface transformation config)
4) also, you need to configure an acl and assign it to the voip interface defining which traffic is allowed.  however, if you wish, you can assign it the same security-level of the inside interface and then just ensure the ASA is configure for inter-interface communication
0
 
LVL 1

Author Comment

by:jetli87
Comment Utility
Thanks Cyclops, i'll test out the config this weekend and get back to you.

until then, enjoy!
0
 

Expert Comment

by:etonnemacher
Comment Utility
Hey cyclops - the asa 5505 doesn't do virtual interfaces does it?
0
 
LVL 25

Expert Comment

by:Cyclops3590
Comment Utility
yes, but how many depends on the license you have; base or security plus
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

How to configure Site to Site VPN on a Cisco ASA.     (version: 1.1 - updated August 6, 2009) Index          [Preface]   1.    [Introduction]   2.    [The situation]   3.    [Getting started]   4.    [Interesting traffic]   5.    [NAT0]   6.…
This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
It is a freely distributed piece of software for such tasks as photo retouching, image composition and image authoring. It works on many operating systems, in many languages.
This video shows how to remove a single email address from the Outlook 2010 Auto Suggestion memory. NOTE: For Outlook 2016 and 2013 perform the exact same steps. Open a new email: Click the New email button in Outlook. Start typing the address: …

762 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

12 Experts available now in Live!

Get 1:1 Help Now