Cisco ASA Question

Hi there,

I have an ASA running the internal network out one interface (let's call it int1 on network 1) and a wless guest out of another (let's call it int2 on network 2). So far so good, each segments connects to its own switch and things are properly routed to the web. I'd like however to have the APs broadcast the internal network and guest ssids (out of the same ap). reading the ap documentation i see the options to create the virtual ap and associate it with another vlan (network 2 in this case) My question is this: I can trunk the ports to the AP for both vlans but do I need to do anything on the ASA int1 as it's configured as network 1 and the guest clients will be going to network 2?

jorge diazSEAsked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

ArchiTech89IT Security EngineerCommented:

A couple of things... Which model ASA is it? Also, what ASA version are you running?

If I understand correctly, you have port associated with the internal network. Something like
int et0/1
  desc internal network
  nameif inside
  security-level 100
  ip address x.x.x.x x.x.x.x

int et0/0
  desc public network
  nameif outside
  security-level 0
  ip address x.x.x.x x.x.x.x

It also appears you have another "guest" network that leads to a wireless access point. Something like
int et0/2
  desc guest network
  nameif guest
  security-level 25
  ip address x.x.x.x x.x.x.x

From there, I'm assuming that you want the the internal network available from the wireless one. Is that right?

To do so, I believe you'll need a few things...

First, you'll want to create a separate SSID for an internal network on the APs--this should be different than the internal network itself. It seems like this is what you're describing already. The APs should then handle both the guest, and the WiFi-based internal network segment. That way, user devices could only connect to one SSID or the other... Is that what you're saying?

You could use identity NAT from the internal segment to the WiFi-based internal segment to create static mappings so the internal IPs could be visible.

You'd have to create static routes pointing to the WiFi internal network. You'll also need an access-list that allows the traffic from the WiFi internal network to the internal network.

These are just cursory suggestions based on what I think you're trying to do. Would you want to post the sh run int output for all three of the existing interfaces (not including proprietary IP addresses)? That, and knowing the ASA model and software version would certainly help...


Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
WissamSenior Network EngineerCommented:
Are both networks (internal users and guests) spanned to same switch on different vlans?
Or what is connected to the different ASA interfaces?
jorge diazSEAuthor Commented:
hello everyone, sorry about the delay. I was unavailable.

to answer the questions:
it's a ASA 5516, v. 9.6(2)3
I'm running each network out different ints on the ASA, so each int connects to a separate switch for each segment.

On the switch side we're running the Cisco SMB models (SG200) so it's gui configuration via web browser.

I just uploaded a quick network drawing of what i have and what i intend to do.

thanks again for your help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.