ND_2007
asked on
NEED HELP with Cisco ASA VLANs configuration
I have a new base ASA 5505 that I am using to connect to a cable modem as a second internet connection for all internal users internet access. I have an existing PIX 506e that manages the VPN passthrough, a DMZ, and another VLAN for a set of T1's. I have setup my new ASA with 2 VLANs (inside, outside) and things work fine from that perspective in regards to internet access etc.
My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.
The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.
Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
My issue is allowing users on my inside VLAN from the ASA to access an existing DMZ VLAN setup by the PIX that is trunked through my layer 2 switches. Do I need to make all VLANS match on the ASA and PIX? Example my DMZ is VLAN 3 on my PIX do I need to make it that on the ASA and also dedicate it to a port even though my switches are trunking the DMZ successfully across the network? I know the base only allows one VLAN per port which is not a problem since I will only have 3 of the 8 ports in use.
The base ASA also restricts the 3rd VLAN initiating access to one of the other two VLAN's which is fine since the outside will not access the VLAN via the ASA but rather the PIX. I can access my VLAN2 inside (PIX) from VLAN1 inside (ASA) without issue so I don't think making them the same named VLAN matters but I may be wrong.
Finally the only thing I really need to do from my inside VLANs to the DMZ is ssh (SFTP) and FTP because it houses an externally accessed server which we need to post files to internally for external retrieval. This all works flawlessly through the current PIX config.
The short answer is the base 5505 license has no support for VLAN trunking - so if you only have two VLANs (assuming you use the management port as a network uplink) you can assign one port to each VLAN - otherwise you'd need to upgrade to a Security Plus license.
ASKER
I am not trunking on the ASA but rather connecting directly with a port from a switch using DMZ VLAN to a port on the ASA. See below for idea of how it is set up.
On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1
On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1
On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)
This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
On ASA
port 0 as outside VLAN2
port 1 as inside VLAN1 192.168.19.1
port 7 as DMZ VLAN12 with (restricted outside VLAN2 as required by license) 192.168.20.1
On PIX
outside VLAN native
inside VLAN2 192.168.19.1
DMZ VLAN3 192.168.20.1
On Layer 2 Switch
port 15, 16 DMZ VLAN3 with 15 connecting to port 7 on ASA (this switch is trunked with other switches allowing all using PIX as gateway to get access to DMZ)
This setup would allow VLAN1 to initiate with DMZ VLAN12 on the ASA since the outside on the ASA is restricted to the DMZ and not the inside on the ASA right? outside access to the DMZ comes in through my PIX.
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.