Cisco ASA Question

jorge diaz
jorge diaz used Ask the Experts™
Hi there,

I have an ASA running the internal network out one interface (let's call it int1 on network 1) and a wless guest out of another (let's call it int2 on network 2). So far so good, each segments connects to its own switch and things are properly routed to the web. I'd like however to have the APs broadcast the internal network and guest ssids (out of the same ap). reading the ap documentation i see the options to create the virtual ap and associate it with another vlan (network 2 in this case) My question is this: I can trunk the ports to the AP for both vlans but do I need to do anything on the ASA int1 as it's configured as network 1 and the guest clients will be going to network 2?

Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
IT Security Engineer

A couple of things... Which model ASA is it? Also, what ASA version are you running?

If I understand correctly, you have port associated with the internal network. Something like
int et0/1
  desc internal network
  nameif inside
  security-level 100
  ip address x.x.x.x x.x.x.x

int et0/0
  desc public network
  nameif outside
  security-level 0
  ip address x.x.x.x x.x.x.x

It also appears you have another "guest" network that leads to a wireless access point. Something like
int et0/2
  desc guest network
  nameif guest
  security-level 25
  ip address x.x.x.x x.x.x.x

From there, I'm assuming that you want the the internal network available from the wireless one. Is that right?

To do so, I believe you'll need a few things...

First, you'll want to create a separate SSID for an internal network on the APs--this should be different than the internal network itself. It seems like this is what you're describing already. The APs should then handle both the guest, and the WiFi-based internal network segment. That way, user devices could only connect to one SSID or the other... Is that what you're saying?

You could use identity NAT from the internal segment to the WiFi-based internal segment to create static mappings so the internal IPs could be visible.

You'd have to create static routes pointing to the WiFi internal network. You'll also need an access-list that allows the traffic from the WiFi internal network to the internal network.

These are just cursory suggestions based on what I think you're trying to do. Would you want to post the sh run int output for all three of the existing interfaces (not including proprietary IP addresses)? That, and knowing the ASA model and software version would certainly help...

WissamSenior Network Engineer

Are both networks (internal users and guests) spanned to same switch on different vlans?
Or what is connected to the different ASA interfaces?
hello everyone, sorry about the delay. I was unavailable.

to answer the questions:
it's a ASA 5516, v. 9.6(2)3
I'm running each network out different ints on the ASA, so each int connects to a separate switch for each segment.

On the switch side we're running the Cisco SMB models (SG200) so it's gui configuration via web browser.

I just uploaded a quick network drawing of what i have and what i intend to do.

thanks again for your help.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial