Forwarding subnet to firewall

Unanswered Question
Apr 7th, 2009
User Badges:

I have a Cisco AP with a Guest VLAN which is at a branch office. What is the best method to forward this VLAN to our ASA interface which is located across MPLS at our corporate office?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mike-greene Tue, 04/07/2009 - 06:24
User Badges:
  • Bronze, 100 points or more

Hi,


Depending on your security policy for your guest network, I would put an ACL blocking/allowing traffic on the layer three interface representing the default gateway of the guest vlan. We typically allow DHCP, DNS, block all traffic to internal subnets including all RFC 1918 addresses and then permit full IP. I would then let your normal routing get the traffic to your ASA. Depending if your ASA's are running a dynamic routing protocol you'll need a static route in the ASA so traffic can get back to the guests on the vlan.


Cisco recommends an anchor WLC to tunnel guest traffic from wireless networks to the edge so that would be an option as well if you have WLC's on your network.


HTH.

Actions

This Discussion