Solved

NEED HELP with Cisco ASA VLANs configuration

Posted on 2009-05-15
3
616 Views
Last Modified: 2012-05-07
I have a new base ASA 5505 that I am using to connect to a cable modem as a second internet connection for all internal users internet access. I have an existing PIX 506e that manages the VPN passthrough, a DMZ, and another VLAN for a set of T1's. I have setup my new ASA with 2 VLANs (inside, outside) and things work fine from that perspective in regards to internet access etc.

My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.

The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.

Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
0
Comment
Question by:ND_2007
  • 2
3 Comments
 
LVL 10

Expert Comment

by:stsonline
Comment Utility
The short answer is the base 5505 license has no support for VLAN trunking - so if you only have two VLANs (assuming you use the management port as a network uplink) you can assign one port to each VLAN - otherwise you'd need to upgrade to a Security Plus license.
0
 
LVL 1

Author Comment

by:ND_2007
Comment Utility
I am not trunking on the ASA but rather connecting directly with a port from a switch using DMZ VLAN to a port on the ASA. See below for idea of how it is set up.

On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1

On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1

On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)

This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
0
 
LVL 1

Accepted Solution

by:
ND_2007 earned 0 total points
Comment Utility
please close this question was not answered.
0

Featured Post

How to improve team productivity

Quip adds documents, spreadsheets, and tasklists to your Slack experience
- Elevate ideas to Quip docs
- Share Quip docs in Slack
- Get notified of changes to your docs
- Available on iOS/Android/Desktop/Web
- Online/Offline

Join & Write a Comment

Suggested Solutions

Exchange server is not supported in any cloud-hosted platform (other than Azure with Azure Premium Storage).
When it comes to security, there are always trade-offs between security and convenience/ease of administration. This article examines some of the main pros and cons of using key authentication vs password authentication for hosting an SFTP server.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're interested in additional methods for monitoring bandwidt…

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

10 Experts available now in Live!

Get 1:1 Help Now