Go Premium for a chance to win a PS4. Enter to Win

  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 417
  • Last Modified:

Deploying ASA5505 on a SBS 2003 network (Converting from Dual to Single-NIC operation)

Dear Experts,


We have a ‘SBS 2003 Standard – SP2’ machine on an HP Proliant ML350 G4 hardware. Its running our Exchange, AD, NAT/Firewall, DHCP, DNS, SharePoint, Remote Access (VPN), SQL, Printing & File server and internet. There is no ISA installed. I have purchased a Cisco ASA5505 to deploy between the internet router and network switch. We also have a Windows 2003 Standard server (virtual) for redundancy and have assigned it Sec DC, Sec DNS roles and global catalogue.
Current Network :  Internet Router --> Server’s-NIC1(Public/External_IP)  [=]  Server’s-NIC2-(Internal_IP)  --> Switch --> Workstations
Planned network:  Internet Router --> ASA5505-Firewall  --> Switch --> Server and Workstations



Convert the server from dual-NIC to Single-Nic mode.


Phase one: Configure ASA5505 to do NAT and firewall function and deploy it. Also configure a VPN pass-through so SBS 2003 can carry on serving VPN clients


Phase 2:  Configure ASA5505 to do VPN function


Phase 3: Install VPN clients on client machines



I need a user guide which clearly explains all the steps involved in converting the SBS 2003 server to Single-NIC mode.


ASA5505 is my first ever firewall – any links/user guides to configure it for the first time will greatly help


SBS 2003 also performs DNS. Will the SBS 2003 keep it’s DNS role? Or it should also be given to ASA5505Thanks for any input. Other tips/ideas will also be greatly appreciated.  
Abid Muhammad
Abid Muhammad
3 Solutions

3. ASA's cannot act as a DNS server - they will route DNS requests however you couldnt point the SBS server to the ASA as a forwarder and leave it be.

The VPN config is relativley simple on the ASA if you use the GUI (ASDM) and the VPN Wizard.

there is also a wealth of guides out there for this

RE the SBS server nic config.

In a nutshell you want to break any RAS or routing entires that you have but preserve the internal network IP - your server will become just another host on your network (but providing DHCP and DNS to hosts)

just imagine a home network where you have a pc connecting to the router as its default gateway. instead of your server being the default route for your internal network it will be another host - not too sure on the step by steps for this for the purposes of documentation but i could defo do it if i was sitting infront of the server and could see the config etc.
Abid MuhammadIT ManagerAuthor Commented:
Many thanks guys,

I have now got the answers to Question 2 (initial configuration) and 3 (DNS). My Firewall has also arrived and it has a CD with lots of documentation and also a printed quick-start guide which was very helpful. The Youtube link is also proving to be a very good resource.

However, I still need instructions on how to do the dual to single-NIC as this is a production server and being a SBS it runs the core of our IT so I need to be very careful with it.

On another note, because the SBS-2003 is working as the default gateway at the moment so we lose internet connectivity if the server is down. I believe once the ASA5505 is deployed it will start working as the default gateway and we will continue to have internet even if the SBS2003 is down.

I am still confused about certain things which I am hoping to find an answer for once I have managed to run the Start-up Wizard on ASDM and enter some details to have a play with the configs etc.
Nothing ever in the clear!

This technical paper will help you implement VMware’s VM encryption as well as implement Veeam encryption which together will achieve the nothing ever in the clear goal. If a bad guy steals VMs, backups or traffic they get nothing.

Gary ColtharpSr. Systems EngineerCommented:
You firewall configuration on SBS 2003 is most likely handled by the RAS service. To get rid of the config, clear and reconfigure RAS and disable the secondary interface. Then after your ASA is configured, re run the internet connection wizard to use a local router.

Your plan seems to imply you will be doing VPN on both windows and the ASA? Can you clarify?
Abid MuhammadIT ManagerAuthor Commented:
Hi gcoltharp,

I am willing to just put the hardware firewall (will pre-configure it) in place after I have converted the server from dual-to-single NIC.

I don't want the ASA to do the VPN at this stage and just forward the VPN requests to SBS2003. Just so that I get more time and understanding of things.

Once all is settled then I will configure ASA5505 to do the VPN and will install the VPN clients on end user machines so they start using the new VPN-utility.

Once ASA5505 has taken the VPN role fully I will remove the VPN function from SBS2003.

This is just what I think I will (and be able to) do to make things easy and not break the whole system. Does it make sense?
Gary ColtharpSr. Systems EngineerCommented:
It makes sense... I would just let RAS handle the VPN always but the Cisco client is marginally more secure.  Just one or the other, cant do both.
Abid MuhammadIT ManagerAuthor Commented:
Thanks for the help everyone. Closing this post and will post any new - more specific questions in a new post.

Kind regards,

Featured Post

Configuration Guide and Best Practices

Read the guide to learn how to orchestrate Data ONTAP, create application-consistent backups and enable fast recovery from NetApp storage snapshots. Version 9.5 also contains performance and scalability enhancements to meet the needs of the largest enterprise environments.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now