I am trying to set up two Cisco ASA5506 firewalls for a client. I'd like to configure and test them in my office such that they don't need any changes when put into the field.
I thought that I ought to be able to do this with two inexpensive routers between the ASAs. I have mapped out what I think will work but wanted some input before I went down this path.
The general setup of the ASAs is that they will provide internet access from the LAN, a site-to-site VPN between them for non-internet traffic, and some port forwarding for remote access. I'm not looking for configuration assistance with that (yet), but want to know if I can get the "simulated internet" correct.
My proposed configuration is as follows. The WAN addresses are fictitious for this posting. I'll use the proper ones from the ISPs on the real simulation and configuration. I'll use crossover cables if needed between routers.
Keep in mind that the temporary routers will be standard home routers that won't have sophisticated capabilities. I do expect them to support a DMZ and also static routing.
CiscoA (ASA at Site A)
Connect WAN port of CiscoA to WAN port of TempRouter1
DNS: 220.127.116.11 (shouldn't matter)
Connect LAN port of TempRouter1 to LAN port of TempRouter2
Connect WAN port of TempRouter2 to WAN port of CiscoB
CiscoB (ASA at Site B)
DHCP: 192.168.112.100 - .199
I figure that if I connect a computer to the 10.10.10.x network (LAN side of the temporary routers) with the appropriate gateway, I can test remote access (through ASA port forwarding) to either site. If I put a web server on the 10.10.10.x network then I can test internet access from either site (adjusting the gateway address on the web server accordingly). I'm not concerned about testing access to the DNS.
Am I on the right track here?
The only tricky part related to getting traffic coming in one temporary router's WAN port to be sent out the other temporary router's WAN port. I figured that using the DMZ approach should suffice. Would I be better off doing a static route on both of the temporary routers instead?