We help IT Professionals succeed at work.

Cisco ASA Firewall Configuration Help needed!

287 Views
Last Modified: 2018-09-19
Hi All,

I need some assistance setting up the below. I've got 3 "subnets" to set up internally. All must be able to reach the internet through the suppliers router.

The networks are 2x /26 and 1x /27. VLANS 601 & 603 are desktop pc's. VLAN 602 will be Cisco phones. 601 and 603 do not need any seperation, they're just to cover the seperate DHCP ranges. DHCP will be provided by an external source (hopefully) through a VPN setup on the ASA Firewall. I'm looking to setup outside interface, inside interface and access for all vlans.

Is anyone able to provide a sample config on how I could get this working?

Network Overview
Thanks,

J
Comment
Watch Question

CERTIFIED EXPERT

Commented:
It looks from your diagram as if you have public addresses for each of the VLANs.

If you have three public subnets from your ISP, you could either use a L3 switch, or if your ASA is suitably licensed have each subnet connected to a dedicated (or VLAN trunk) interface on the ASA that then connects to the VLAN on the switch.

Author

Commented:
Hi ArneLovius,

The IP ranges are sanitised, but will be part of an MPLS network, not public however.

Thanks,

John
mikecrIT Architect/Technology Delivery Manager
CERTIFIED EXPERT

Commented:
I'm confused. You're using the subnets you specify on the interfaces of the ASA. Are these subnets internal to the ASA? If they are, then routed vlans should be configured on the switch for each subnet. You should then create another totally separate subnet/vlan that will have the inside interface of the ASA connected to it. You will then set up routing on the router and ASA to access your internal subnets but I would probably use PAT on the firewall to hide all the networks and give them access to the internet.
CERTIFIED EXPERT

Commented:
interface Ethernet0/0
 switchport access vlan 10
!
interface Ethernet0/1
 switchport access vlan 601
!
interface Ethernet0/2
 switchport access vlan 602
!
interface Ethernet0/3
 switchport access vlan 603

!
interface Vlan10
 nameif MPLSRouter
 security-level 100
 ip address 123.123.25.66 255.255.255.224

!
interface Vlan601
 nameif VLAN601
 security-level 100
 ip address 123.123.24.64 255.255.255.224
!
interface Vlan602
 nameif VLAN602
 security-level 100
 ip address 123.123.24.97 255.255.255.224
!
interface Vlan603
 nameif VLAN603
 security-level 100
 ip address 123.123.24.66 255.255.255.192
Pete LongTechnical Architect
CERTIFIED EXPERT
Distinguished Expert 2019

Commented:
ArneLovius its a 5506-X buddy not a 5505.
CERTIFIED EXPERT

Commented:
@PeteLong, good point well made!

Author

Commented:
Okay,

So the 5506-X can't be used as switch ports.

How do I overcome that?

Thanks in advance
CERTIFIED EXPERT
Commented:
This problem has been solved!
(Unlock this solution with a 7-day Free Trial)
UNLOCK SOLUTION

Gain unlimited access to on-demand training courses with an Experts Exchange subscription.

Get Access
Why Experts Exchange?

Experts Exchange always has the answer, or at the least points me in the correct direction! It is like having another employee that is extremely experienced.

Jim Murphy
Programmer at Smart IT Solutions

When asked, what has been your best career decision?

Deciding to stick with EE.

Mohamed Asif
Technical Department Head

Being involved with EE helped me to grow personally and professionally.

Carl Webster
CTP, Sr Infrastructure Consultant
Empower Your Career
Did You Know?

We've partnered with two important charities to provide clean water and computer science education to those who need it most. READ MORE

Ask ANY Question

Connect with Certified Experts to gain insight and support on specific technology challenges including:

  • Troubleshooting
  • Research
  • Professional Opinions