Deploying ASA5505 on a SBS 2003 network (Converting from Dual to Single-NIC operation)

Dear Experts,


We have a ‘SBS 2003 Standard – SP2’ machine on an HP Proliant ML350 G4 hardware. Its running our Exchange, AD, NAT/Firewall, DHCP, DNS, SharePoint, Remote Access (VPN), SQL, Printing & File server and internet. There is no ISA installed. I have purchased a Cisco ASA5505 to deploy between the internet router and network switch. We also have a Windows 2003 Standard server (virtual) for redundancy and have assigned it Sec DC, Sec DNS roles and global catalogue.
Current Network :  Internet Router --> Server’s-NIC1(Public/External_IP)  [=]  Server’s-NIC2-(Internal_IP)  --> Switch --> Workstations
Planned network:  Internet Router --> ASA5505-Firewall  --> Switch --> Server and Workstations



Convert the server from dual-NIC to Single-Nic mode.


Phase one: Configure ASA5505 to do NAT and firewall function and deploy it. Also configure a VPN pass-through so SBS 2003 can carry on serving VPN clients


Phase 2:  Configure ASA5505 to do VPN function


Phase 3: Install VPN clients on client machines



I need a user guide which clearly explains all the steps involved in converting the SBS 2003 server to Single-NIC mode.


ASA5505 is my first ever firewall – any links/user guides to configure it for the first time will greatly help


SBS 2003 also performs DNS. Will the SBS 2003 keep it’s DNS role? Or it should also be given to ASA5505Thanks for any input. Other tips/ideas will also be greatly appreciated.  
Abid MuhammadIT ManagerAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.


3. ASA's cannot act as a DNS server - they will route DNS requests however you couldnt point the SBS server to the ASA as a forwarder and leave it be.

The VPN config is relativley simple on the ASA if you use the GUI (ASDM) and the VPN Wizard.

there is also a wealth of guides out there for this

RE the SBS server nic config.

In a nutshell you want to break any RAS or routing entires that you have but preserve the internal network IP - your server will become just another host on your network (but providing DHCP and DNS to hosts)

just imagine a home network where you have a pc connecting to the router as its default gateway. instead of your server being the default route for your internal network it will be another host - not too sure on the step by steps for this for the purposes of documentation but i could defo do it if i was sitting infront of the server and could see the config etc.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Abid MuhammadIT ManagerAuthor Commented:
Many thanks guys,

I have now got the answers to Question 2 (initial configuration) and 3 (DNS). My Firewall has also arrived and it has a CD with lots of documentation and also a printed quick-start guide which was very helpful. The Youtube link is also proving to be a very good resource.

However, I still need instructions on how to do the dual to single-NIC as this is a production server and being a SBS it runs the core of our IT so I need to be very careful with it.

On another note, because the SBS-2003 is working as the default gateway at the moment so we lose internet connectivity if the server is down. I believe once the ASA5505 is deployed it will start working as the default gateway and we will continue to have internet even if the SBS2003 is down.

I am still confused about certain things which I am hoping to find an answer for once I have managed to run the Start-up Wizard on ASDM and enter some details to have a play with the configs etc.
Ultimate Tool Kit for Technology Solution Provider

Broken down into practical pointers and step-by-step instructions, the IT Service Excellence Tool Kit delivers expert advice for technology solution providers. Get your free copy now.

Gary ColtharpSr. Systems EngineerCommented:
You firewall configuration on SBS 2003 is most likely handled by the RAS service. To get rid of the config, clear and reconfigure RAS and disable the secondary interface. Then after your ASA is configured, re run the internet connection wizard to use a local router.

Your plan seems to imply you will be doing VPN on both windows and the ASA? Can you clarify?
Abid MuhammadIT ManagerAuthor Commented:
Hi gcoltharp,

I am willing to just put the hardware firewall (will pre-configure it) in place after I have converted the server from dual-to-single NIC.

I don't want the ASA to do the VPN at this stage and just forward the VPN requests to SBS2003. Just so that I get more time and understanding of things.

Once all is settled then I will configure ASA5505 to do the VPN and will install the VPN clients on end user machines so they start using the new VPN-utility.

Once ASA5505 has taken the VPN role fully I will remove the VPN function from SBS2003.

This is just what I think I will (and be able to) do to make things easy and not break the whole system. Does it make sense?
Gary ColtharpSr. Systems EngineerCommented:
It makes sense... I would just let RAS handle the VPN always but the Cisco client is marginally more secure.  Just one or the other, cant do both.
Abid MuhammadIT ManagerAuthor Commented:
Thanks for the help everyone. Closing this post and will post any new - more specific questions in a new post.

Kind regards,
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.

Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.