Solved

NEED HELP with Cisco ASA VLANs configuration

Posted on 2009-05-15
3
632 Views
Last Modified: 2012-05-07
I have a new base ASA 5505 that I am using to connect to a cable modem as a second internet connection for all internal users internet access. I have an existing PIX 506e that manages the VPN passthrough, a DMZ, and another VLAN for a set of T1's. I have setup my new ASA with 2 VLANs (inside, outside) and things work fine from that perspective in regards to internet access etc.

My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.

The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.

Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
0
Comment
Question by:ND_2007
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
3 Comments
 
LVL 10

Expert Comment

by:stsonline
ID: 24399586
The short answer is the base 5505 license has no support for VLAN trunking - so if you only have two VLANs (assuming you use the management port as a network uplink) you can assign one port to each VLAN - otherwise you'd need to upgrade to a Security Plus license.
0
 
LVL 1

Author Comment

by:ND_2007
ID: 24399728
I am not trunking on the ASA but rather connecting directly with a port from a switch using DMZ VLAN to a port on the ASA. See below for idea of how it is set up.

On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1

On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1

On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)

This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
0
 
LVL 1

Accepted Solution

by:
ND_2007 earned 0 total points
ID: 25582796
please close this question was not answered.
0

Featured Post

Online Training Solution

Drastically shorten your training time with WalkMe's advanced online training solution that Guides your trainees to action. Forget about retraining and skyrocket knowledge retention rates.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

On Feb. 28, Amazon’s Simple Storage Service (S3) went down after an employee issued the wrong command during a debugging exercise. Among those affected were big names like Netflix, Spotify and Expedia.
This program is used to assist in finding and resolving common problems with wireless connections.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

617 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question