Security Solution

Unanswered Question
May 2nd, 2008
User Badges:

Dear All

I have a network which segmented to 5 segments (Servers, Staff, Studnets, Guests, DMZ) + two fiber lines for internet connectivity from my ISP.

I would like to find a solution which allow me to terminate all segments and internet lines to it then apply a protection rules ( virus scanning, web filtering etc)

this device should cover the following functions.

Firewall, antivirus, anti spam, web filtering, VPN...

I checked ASA 5500 series but it has a problem in No. of ports available. (5540 has 4 ports only)

any advices ??

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 4 (2 ratings)
Loading.
rkalia1 Sun, 05/04/2008 - 13:40
User Badges:

You can create a subinterface on say DMZ interface and put it in a different VLAN to separate from the DMZ network. You need to enable trunking on the switch port which connects to the DMZ physical port on ASA 5500.

Suppose you use gig0/2 on the ASA as DMZ. Then you can do the following to create segment STUDENTS on this interface :


ASA(config)#interface GigabitEthernet0/2.300

ASA(config-if)#nameif DMZ

ASA(config-if)#vlan 300

ASA(config-if)#security-level 50

ASA(config-if)#ip address x.x.x.x 255.255.255.0

ASA(config-if)#exit

ASA(config)#interface GigabitEthernet0/2.301

ASA(config-if)#nameif STUDENTS

ASA(config-if)#vlan 301

ASA(config-if)#security-level 60

ASA(config-if)#ip address y.y.y.y 255.255.255.0


Pls rate if this solves your problem.



Richard Burts Sun, 05/04/2008 - 17:38
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Ahmed


You are correct that in terms of physical interfaces the ASA5540 has only 4 interfaces. But the ASA5540 supports VLANs so if one (or more) of the interfaces are connected to a switch then the number of logical interfaces supported is much higher. According to this data sheet the ASA5540 supports 200 VLANs, which should allow you to segment your network as you want.

http://www.cisco.com/en/US/products/ps6120/prod_models_comparison.html


HTH


Rick

reagentom Sun, 05/04/2008 - 19:38
User Badges:

Thanks all,

do you mean it is possible to create content filter/ firewalling rules per vlan not per interface .. rt ??

Richard Burts Mon, 05/05/2008 - 04:35
User Badges:
  • Super Silver, 17500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Ahmed


Yes it should be possible to create content filter/ firewalling rules per vlan.


HTH


Rick

Actions

This Discussion