Hello NT,
In fact I have understand "must" instead "avoid", mistake in reading.
My router configuration :
interface GigabitEthernet0/0.1
no ip address
interface GigabitEthernet0/0.1
encapsulation dot1Q 1 native
ip address 100.100.100.1 255.255.255.0
And my ASA configuration (Gi0/1 from the ASA is connected to the Gi0/0 port of the router) :
firewall transparent
interface GigabitEthernet0/0
nameif Inside
security-level 100
!
interface GigabitEthernet0/1
nameif Outside
security-level 0
access-list Acl_Inside extended permit icmp any any echo-reply
access-list Acl_Inside extended permit ip any any
access-list Acl_Outside extended permit tcp any any eq www
access-list Acl_Outside extended permit icmp any any
access-group Acl_Inside in interface Inside
access-group Acl_Outside in interface Outside
ip address 100.100.100.2 255.255.255.0
route Inside 100.100.100.0 255.255.255.0 100.100.100.1 1
route Outside 0.0.0.0 0.0.0.0 100.100.100.1 1
With this configuration :
- Any host from the outside or from the inside can connect on the http port from any server.
- But a host on the inside can't open a port (ex. 25) on a machine in the same interface, that doesn't work. It's the correct working, because IP packet use the gateway above the outside interface to return to a host in the inside interface, the firewall block each port not autorize by an ACL.
To solve this issue, I have add an ACL to permit tcp/udp ports :
access-list Acl_Outside extended permit tcp 100.100.100.0 255.255.255.0 any
access-list Acl_Outside extended permit udp 100.100.100.0 255.255.255.0 any
- I this the only/best way to permit trafic on the inside interface ? I have 10 subnets, I dont think it's a rigorous config.
- In transparent mode, route inside/route outside are mandatory ?
Jerome
