Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

ASA5505 to ASA5505 direct connection on inside network, help. (not vpn)

Hello everyone,

I will begin to tell that i'm very close to noob status in this area.

I will try to explain my problem for you, and see if anyone can help me.

The setup is like this:

I have to different cabinets, A and B , each cabinet has a ASA5505 connected to an ISP, a layer 2 switch and some servers.

Each cabinet has it's own subnet.

Between these cabinets is a cat cable. (not connected yet)

The goal is for the servers in each cabinet to be able to communicate to eachother without accessing the internet.

Should this just be a matter of connecting the two ASA's and it will find the subnet on the other side?

Do I have to add some static routes?

NAT's?

ACL changes?

Please point me in the right direction.

I have attached a picture explaining the setup.

Thanks in advance.

Martin

Everyone's tags (4)
1 ACCEPTED SOLUTION

Accepted Solutions
VIP Purple

ASA5505 to ASA5505 direct connection on inside network, help. (n

You have to configure on both ASAs a new VLAN, with a new subnet. This can be used as a transfer network between the ASAs. The static routes point to the other sides IP in that subnet. The ACLs on these new VLAN-interfaces have to permit the needed traffic and the NAT has to be adjusted with NAT-Excemption.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

5 REPLIES

ASA5505 to ASA5505 direct connection on inside network, help. (n

You connect the cable, add a static route on both ASA and add ACL to the new interface to permit trafic between the two firewall. It's pretty simple, no hidden trick here.

Community Member

ASA5505 to ASA5505 direct connection on inside network, help. (n

Thanks!, i'll try that.

Might get back with more questions.

/Martin

Community Member

ASA5505 to ASA5505 direct connection on inside network, help. (n

Hi Dominic,

It does not seem to work,

Shouldn't there be a problem when i connect a cable from  Vlan1 (10.0/24) on ASA-A to Vlan1 (70.0/24) on ASA-B ?

If I look in the ARP and routing tables, the ASA does not "see" the network on the other side.

Thanks again!

/Martin

VIP Purple

ASA5505 to ASA5505 direct connection on inside network, help. (n

You have to configure on both ASAs a new VLAN, with a new subnet. This can be used as a transfer network between the ASAs. The static routes point to the other sides IP in that subnet. The ACLs on these new VLAN-interfaces have to permit the needed traffic and the NAT has to be adjusted with NAT-Excemption.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni

Community Member

ASA5505 to ASA5505 direct connection on inside network, help. (n

Thanks Karsten! , it got it to work.

As you said, I added 1 vlan on each ASA, 

ASA A got 192.168.50.0/24 with ip 192.168.50.1

ASA B got 192.168.50.0/24 with ip 192.168.50.2

and I added the static routes

ASA A points to 192.168.50.2 when traffic is intended for the B network

ASA B points to 192.168.50.1 when traffic is intended for the A network

I allowed same security level networks to pass traffic to each other.

No NAT's where needed to make it work.

Next I will look into ACL to limit the traffic allowed between the networks.

Thanks all for your help.

Have a nice day!

/Martin

335
Views
0
Helpful
5
Replies
CreatePlease to create content