asked on

I would like to know what specs to look for a Cisco Switch on this configuration.

Hi:
I am configuring a PIX/ASA and a CISCO switch with the configuration provided by tgerbert but I would like to know what model of switch should I use and what to look for on the switch?
Second: I would like to know what cable is use to trunk between the pix/asa and the switch
Third: Will the PIX/ASA 5505 work fine?.

Please advise.
NetDiagram.jpg

SOLUTION

memo_tnt

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

chenzovicc

ASKER

The reality is that the customer I have does not want to spend much as he is going to buy the
CISCO/ASA 5505.

Will the 2924 or 2950 work fine?. Please advise me as you are expert on this things.

ASKER CERTIFIED SOLUTION

Les Moore

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

chenzovicc

ASKER

I know this could be another question but according to the diagram I provided for you.
Can I just configure E 0/1 with network 172.168.1.0 and place a linksys switch and on port E 0/2
with network 192.168.1.0 and place a linksys switch?

Thanks.

Les Moore

Yes, that will work fine but if the two networks need to talk to each other, be careful of the license on the ASA5505 because most options restrict communications between the vlans. The Sec+ does not restrict it.

chenzovicc

ASKER

I need the two networks to be completely separate as they are 2 different businesses(One is investments and another Insurance but in the same office) so I think it will work fine.
Now Do I have to assign the same security level to E 0/1 and E 0/2.

Thanks

Les Moore

No, you can assign e1 default inside security level of 100 and e2 as level 99 if you want

chenzovicc

ASKER

I configured the pix and try to connect my laptop directly into the port e 0/1 with the 192.168.1.1
and I was able to connect into the internet but when I try to connect with my laptop directly into the port
e 0/2 ip address 10.0.0.1 I can not access the internet. I am providing the configuration if you can please
advise why I can not connect on that port.

Thanks

This is the configuration:

:
ASA Version 7.2(4)
!
hostname CASA
domain-name cib.com
enable password 1plFi encrypted
passwd 2K encrypted
names
!
interface Vlan1
nameif inside
security-level 100
ip address 192.168.1.1 255.255.255.0
!
interface Vlan2
no forward interface Vlan1
nameif REALESTATE
security-level 97
ip address 10.0.0.1 255.255.255.0
!
interface Vlan11
nameif outside
security-level 0
ip address dhcp setroute
!
interface Ethernet0/0
switchport access vlan 11
!
interface Ethernet0/1
!
interface Ethernet0/2
switchport access vlan 2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!
ftp mode passive
dns server-group DefaultDNS
domain-name cib.com
pager lines 24
mtu inside 1500
mtu REALESTATE 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-524.bin
no asdm history enable
arp timeout 14400
global (outside) 101 interface
nat (inside) 101 0.0.0.0 0.0.0.0
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
http server enable
http 192.168.1.15 255.255.255.255 inside
http 192.168.1.0 255.255.255.255 inside
http 10.0.0.0 255.255.255.255 REALESTATE
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 192.168.1.0 255.255.255.255 inside
telnet 192.168.1.15 255.255.255.255 inside
telnet timeout 5
ssh timeout 5
console timeout 0
dhcp-client client-id interface outside

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
message-length maximum 512
policy-map global_policy
class inspection_default
inspect dns preset_dns_map
inspect ftp
inspect h323 h225
inspect h323 ras
inspect netbios
inspect rsh
inspect rtsp
inspect skinny
inspect esmtp
inspect sqlnet
inspect sunrpc
inspect tftp
inspect sip
inspect xdmcp
!
service-policy global_policy global
prompt hostname context
Cryptochecksum:01722997b6d2a11c7d6f92d0f564dc2a
: end
asdm image disk0:/asdm-524.bin
no asdm history enable

User Access Verification

Password:
Type help or '?' for a list of available commands.
CA> en
Password: ******
CASA# config t
CASA(config)# sh ver

Cisco Adaptive Security Appliance Software Version 7.2(4)
Device Manager Version 5.2(4)

Compiled on Sun 06-Apr-08 13:39 by builders
System image file is "disk0:/asa724-k8.bin"
Config file at boot was "startup-config"

CASA up 24 mins 9 secs

Hardware: ASA5505, 256 MB RAM, CPU Geode 500 MHz
Internal ATA Compact Flash, 128MB
BIOS Flash Firmware Hub @ 0xffe00000, 1024KB

Encryption hardware device : Cisco ASA-5505 on-board accelerator (revision 0x0)
Boot microcode : CNlite-MC-Boot-Cisco-

Licensed features for this platform:
Maximum Physical Interfaces : 8
VLANs : 3, DMZ Restricted
Inside Hosts : 50
Failover : Disabled
VPN-DES : Enabled
VPN-3DES-AES : Enabled
VPN Peers : 10
WebVPN Peers : 2
Dual ISPs : Disabled
VLAN Trunk Ports : 0

This platform has a Base license.

Serial Number: JMX13
Running Activation Key: 0xd307f771 0xa3d46c94 0x48261487
Configuration register is 0x1
Configuration last modified by enable_15 at 15:34:04.582 UTC Wed Mar 23

SOLUTION

Les Moore

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

chenzovicc

ASKER

Thanks memo and Irmoore for your answers to my questions. Thanks for the last reply Irmoore works fine
when I add the nat.