Solved

NEED HELP with Cisco ASA VLANs configuration

Posted on 2009-05-15
3
619 Views
Last Modified: 2012-05-07
I have a new base ASA 5505 that I am using to connect to a cable modem as a second internet connection for all internal users internet access. I have an existing PIX 506e that manages the VPN passthrough, a DMZ, and another VLAN for a set of T1's. I have setup my new ASA with 2 VLANs (inside, outside) and things work fine from that perspective in regards to internet access etc.

My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.

The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.

Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
0
Comment
Question by:ND_2007
  • 2
3 Comments
 
LVL 10

Expert Comment

by:stsonline
ID: 24399586
The short answer is the base 5505 license has no support for VLAN trunking - so if you only have two VLANs (assuming you use the management port as a network uplink) you can assign one port to each VLAN - otherwise you'd need to upgrade to a Security Plus license.
0
 
LVL 1

Author Comment

by:ND_2007
ID: 24399728
I am not trunking on the ASA but rather connecting directly with a port from a switch using DMZ VLAN to a port on the ASA. See below for idea of how it is set up.

On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1

On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1

On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)

This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
0
 
LVL 1

Accepted Solution

by:
ND_2007 earned 0 total points
ID: 25582796
please close this question was not answered.
0

Featured Post

Is Your Active Directory as Secure as You Think?

More than 75% of all records are compromised because of the loss or theft of a privileged credential. Experts have been exploring Active Directory infrastructure to identify key threats and establish best practices for keeping data safe. Attend this month’s webinar to learn more.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Setup NAT/PAT question 3 42
Auto Smartport macro for Dell and HP laptops 2 54
syslog id vs. msg 2 21
VIRTUAL NETWORKING 3 38
Join Greg Farro and Ethan Banks from Packet Pushers (http://packetpushers.net/podcast/podcasts/pq-show-93-smart-network-monitoring-paessler-sponsored/) and Greg Ross from Paessler (https://www.paessler.com/prtg) for a discussion about smart network …
ADCs have gained traction within the last decade, largely due to increased demand for legacy load balancing appliances to handle more advanced application delivery requirements and improve application performance.
Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

861 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

30 Experts available now in Live!

Get 1:1 Help Now