Solved

NEED HELP with Cisco ASA VLANs configuration

Posted on 2009-05-15
3
625 Views
Last Modified: 2012-05-07
I have a new base ASA 5505 that I am using to connect to a cable modem as a second internet connection for all internal users internet access. I have an existing PIX 506e that manages the VPN passthrough, a DMZ, and another VLAN for a set of T1's. I have setup my new ASA with 2 VLANs (inside, outside) and things work fine from that perspective in regards to internet access etc.

My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.

The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.

Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
0
Comment
Question by:ND_2007
  • 2
3 Comments
 
LVL 10

Expert Comment

by:stsonline
ID: 24399586
The short answer is the base 5505 license has no support for VLAN trunking - so if you only have two VLANs (assuming you use the management port as a network uplink) you can assign one port to each VLAN - otherwise you'd need to upgrade to a Security Plus license.
0
 
LVL 1

Author Comment

by:ND_2007
ID: 24399728
I am not trunking on the ASA but rather connecting directly with a port from a switch using DMZ VLAN to a port on the ASA. See below for idea of how it is set up.

On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1

On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1

On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)

This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
0
 
LVL 1

Accepted Solution

by:
ND_2007 earned 0 total points
ID: 25582796
please close this question was not answered.
0

Featured Post

Manage your data center from practically anywhere

The KN8164V features HD resolution of 1920 x 1200, FIPS 140-2 with level 1 security standards and virtual media transmissions at twice the speed. Built for reliability, the KN series provides local console and remote over IP access, ensuring 24/7 availability to all servers.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
For months I had no idea how to 'discover' the IP address of the other end of a link (without asking someone who knows), and it drove me batty. Think about it. You can't use Cisco Discovery Protocol (CDP) because it's not implemented on the ASAs.…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…
Both in life and business – not all partnerships are created equal. Spend 30 short minutes with us to learn:   • Key questions to ask when considering a partnership to accelerate your business into the cloud • Pitfalls and mistakes other partners…

820 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question