ASA5505 as LAN router

[tato386]

I would like to use an ASA5505 as a simple LAN-to-LAN ethernet router.  My plan is to configure two interfaces with the same security level and then use the command that allows interfaces with the same security level to communicate with each other.  Will this work?  I am hoping I can get this to work without having to setup and ACLs or NAT stuff.

Thanks,

Diego

[Julio Carvajal]

Hello Diego,

Yes, it should work with the same-security-permit inter-interface

If you want you can provide the configuration before deploying it to the field and we can check it for you.

Please rate helpful posts

Regards,

Julio

[tato386]

Here is what I have so far.  I would also like to remove the service-policy stuff also. I should also add that there will be a second ASA connected to this ASA.  The second ASA will be configured in the more traditional style.  The purpose of the first ASA is to act like a router that I need to connect to the ISPs /30 WAN IP block.  The second ASA will provide NAT and access rules to a private LAN.

Thanks,

Diego

!
hostname ASA_router
names
!
interface Vlan1
nameif public-LAN
security-level 100
ip address 2.2.2.1 255.255.255.224
!
interface Vlan2
nameif WAN
security-level 100
ip address 1.1.1.2 255.255.255.252
!
interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1
!

...

!
interface Ethernet0/7
!
ftp mode passive
same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
pager lines 24
logging asdm informational
mtu WAN 1500
mtu public-LAN 1500
icmp unreachable rate-limit 1 burst-size 1
icmp permit any WAN
icmp permit any public-LAN
no asdm history enable
arp timeout 14400
route WAN 0.0.0.0 0.0.0.0 1.1.1.1 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout uauth 0:05:00 absolute
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
telnet 0.0.0.0 0.0.0.0 WAN
telnet 0.0.0.0 0.0.0.0 public-LAN
telnet timeout 30
ssh 0.0.0.0 0.0.0.0 WAN
ssh 0.0.0.0 0.0.0.0 public-LAN
ssh timeout 30
console timeout 0

!
class-map inspection_default
match default-inspection-traffic
!
!
policy-map type inspect dns preset_dns_map
parameters
  message-length maximum 512
policy-map global_policy
class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
!
service-policy global_policy global
prompt hostname context

[Julio Carvajal]

Hello Diego,

I can tell you that the MPF (Modular policy framework) its own its default configuration so you do not need to worry about it.

So for the particular setup you are looking for everything should work.

Please rate helpful posts.

Regards,

Julio

[tato386]

Thanks for all your help sir.

Diego

[Julio Carvajal · Accepted solution]

Hello Diego,

It is my pleasure, please mark the question as answered and if you have any other questions  just let me know.

Have a great day.

Julio