Network upgrade: ASA 5505 configuration
Bookmark this page:
 Yahoo!
 Google
 Windows Live
 del.icio.us
 digg
 Netscape
|
|
||||||||||||||||
|
Posted by Andrew Hodgson on June 23, 2008, 5:48 pm
Please log in for more thread options I need to do some IP address rearanging on my Cisco ASA 5505 as I am currently not using NAT and I want to get it to a configuration where my external IP addresses are on the outside interface, and I can use static NAT to map specific internal IP addresses to public IP addresses. I have a couple of questions: - Should this be possible using the ASA 5505, and a Cisco 837 on the outside network IP address block also? - Does anyone have the default configuration file from the ASA 5505 as shipped from Cisco? I think I can get the firewall back to default state, but want to edit the file manually on my PC first. - When I got the unit, I think I didn't have a license for a DMZ IP segment. I had a lot of material with the unit, but couldn't remember off hand whether I could get a free DMZ license from Cisco. Does anyone know if this is possible? The packaging is not here at the moment, but I will find it and try to recover the license if there is one. Thanks. Andrew. | ||||||||||||||||
|
Posted by Legend on June 25, 2008, 6:20 pm
Please log in for more thread options will it work ? no depending upon your router config ... you can not have same IP subnet located twice or in two places in the same internetwork. > - Does anyone have the default configuration file from the ASA 5505 as
http://www.cisco.com/en/US/docs/security/asa/asa72/configuration/guide/start.html#wp1055130
> shipped from Cisco? I think I can get the firewall back to default > state, but want to edit the file manually on my PC first. > - When I got the unit, I think I didn't have a license for a DMZ IP
> segment. I had a lot of material with the unit, but couldn't remember > off hand whether I could get a free DMZ license from Cisco. Does > anyone know if this is possible? The packaging is not here at the > moment, but I will find it and try to recover the license if there is > one. Show version will tell you what your license type is. you need Security plus, for full DMZ. With Base lic you DMZ can not make connection inbound >
> Thanks. > Andrew. HTH Martin | ||||||||||||||||
|
Posted by Andrew Hodgson on June 26, 2008, 6:46 pm
Please log in for more thread options wrote:
>Hi
> >> Hi,
>> >> I need to do some IP address rearanging on my Cisco ASA 5505 as I am >> currently not using NAT and I want to get it to a configuration where >> my external IP addresses are on the outside interface, and I can use >> static NAT to map specific internal IP addresses to public IP >> addresses. >> >> I have a couple of questions: >> >> - Should this be possible using the ASA 5505, and a Cisco 837 on the >> outside network IP address block also? >yes.
>will it work ? >no >depending upon your router config ... >you can not have same IP subnet located twice or in two places in the same >internetwork. This is what I was thinking of doing: Router: interface Ethernet0 ip address xx.xx.xx.209 255.255.255.240 interface Dialer0 ip address negotiated (receives WAN static) Firewall: interface vlan2 nameif outside security-level 0 ip address xx.xx.xx.210 255.255.255.240 interface vlan1 nameif inside ip address 192.168.1.1 255.255.255.0 security-level 100 global (outside) 1 interface global (outside) 2 xx.xx.xx.11-xx.xx.xx.222 netmask 255.255.255.240 nat (inside) 1 0 0 route outside 0.0.0.0 0.0.0.0 xx.xx.xx.209 1 (can this go in the outside interface definition?) access-group outside_access_in in interface outside access-list outside_access_in extended permit tcp any host 192.168.1.10 eq 25 static (inside,outside) xx.xx.xx.211 192.168.1.10 netmask 255.255.255.240 What I want to achieve with this is the following: - All outgoing connections from anything on 192.168.1.0/24 is presented to the outside on xx.xx.xx.209. - I have some server on 192.168.1.10 which I want presenting to the outside world on xx.xx.xx.211. - I want people to connect to the IP address xx.xx.xx.211 on port 25 and they will be connected to this server. Will this do it? Thanks. Andrew. | ||||||||||||||||
>
> I need to do some IP address rearanging on my Cisco ASA 5505 as I am
> currently not using NAT and I want to get it to a configuration where
> my external IP addresses are on the outside interface, and I can use
> static NAT to map specific internal IP addresses to public IP
> addresses.
>
> I have a couple of questions:
>
> - Should this be possible using the ASA 5505, and a Cisco 837 on the
> outside network IP address block also?