Cisco ASA5505 - outside zone

[JohnDbury71]

Hello everyone,

I don't understand how to use the outside zone with Cisco ASA5505. If I create a vlan for my modem, and an other for my LAN, I lose Internet access.

I saw in every manual / tutorial that it is better to have 2 distinct vlans for modem's side and LAN's side but I don't understand why, and how to make it work.

That :

interface Vlan1

nameif inside

security-level 100

ip address 192.168.1.2 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address dhcp setroute

interface Ethernet0/0
switchport access vlan 2
!
interface Ethernet0/1


!
interface Ethernet0/2
!
interface Ethernet0/3
!
interface Ethernet0/4
!
interface Ethernet0/5
!
interface Ethernet0/6
!
interface Ethernet0/7
!

Is not working. But if I remove the command "switchport access vlan 2", I get back my access to the Internet.

Do you have any idea why please ?

Thanks

[Seb Rupik]

Hi John,

VLAN1 is the default VLAN. When you do not explicitly specifiy 'switchport access vlan 2', you have essentially put all of your ports in the same VLAN group, so traffic will flow happily between them.

I would recommend that you do not use VLAN1 as part of your design extension, especially in your case as the most secure VLAN!.

Try the following config:

!

interface Vlan100

nameif inside

security-level 100

ip address 192.168.1.2 255.255.255.0

!

interface eth0/0

switchport access vlan 2

!

interface eth0/1

switchport access vlan 100

!

... also remove your vlan1 SVI config:

no interface vlan1

...plug your modem into eth0/0, and your PC/ switch into eth0/1. By default traffic can flow from a high security vlan to a lower one (100 -> 0). The VLAN number you choose here is arbitarty, it is the 'security-level x' which is important when applied to each VLAN SVI.

From this point on you can now look at using ACLs to allow traffic to flow from the outside to the inside, or DMZ if you choose to have one.

cheers,

Seb.

[Richard Burts]

Seb

I believe that the biggest issue with John's configuration is not the choice to use the default vlan 1 but is the choice to use the same network as seems to also be used by the modem. If John follows your advice and replaces vlan 1 with vlan 100 and continues to use 192.168.1.0 as his inside network then I believe that John will continue to have issues with Internet access.

HTH

Rick

[Richard Burts]

John

It sounds like the modem to which you connect your ASA is also using the network 192.168.1.0 which implies that it is also doing address translation for the traffic from your network going to the Internet. This does have implications for how you configure your ASA.

Perhaps it would be helpful to think about why it does not work when you put Ethernet 0/0 into vlan 2. In vlan 2 the interface will be assigned some address in 192.168.1.0 and the ASA will learn a default route that is most likely 192.168.1.1. All of the hosts connected to other ports of the ASA have addresses in 192.168.1.0 and will try to get to the default gateway of 192.168.1.1. Since they appear to all be in the same subnet they will ARP for the 192.168.1.1 address. But since they are in vlan 1 and the modem is in vlan 2 there will be no response to the ARP request and you have lost Internet access.

To give you good advice about how to configure your ASA we need to start by understanding what it is that you really want to do with the ASA. In its current configuration with all ports in vlan 1 and using network 192.168.1.0 you do have Internet access and the ASA is acting as a switch providing network connectivity to your hosts. But it will not be able to really function as a firewall. It will not be able to examine traffic from your hosts going to the Internet or traffic from the Internet going to your hosts. This is because your hosts will be communicating directly with the modem. If you want the ASA to really function as a firewall then you need to have the outside network be different from the inside network and you need all the traffic from your hosts to have to go through the ASA to get to the Internet.

HTH

Rick

[JohnDbury71]

Yes the modem is acting like a router, DHCP server, NAT/PAT translator, etc. It's a box providing TV (but I don't need it), phone and Internet (via RJ45 and wifi).

I have this modem with IP address : 192.168.1.1, and I would like to have the ASA as a firewall/router/DHCP server between the modem and the switch. If I have to do NAT/PAT and have a network like 10.0.0.0/24 behind the ASA, it's okay but I'm not sure it would be useful.

My need is to control the local network, I don't want to depend on a modem provided by an ISP. I just want it as a gateway to the Internet.

Thanks

[Richard Burts]

John

What you show in the drawing should be reasonable and should work. Can you show us how you were configuring it? With an appropriate DHCP pool/scope configured the ASA should provide addresses to the hosts. With an appropriate set of route commands it should function as the gateway for your hosts and forward their traffic to the modem.

If the modem is going to use address 192.168.1.1 for its connection to you, then I think that you will not be able to turn off its doing address translation. Whatever addressing you are using inside needs to be translated on its way out and the ASA does not have a public address to translate to. And if the modem expects to receive traffic with source addresses in the 192.168.1.0 network then probably you need to configure the ASA to translate the inside addresses (PAT using the ASA "outside" interface address) as it prepares traffic to be forwarded to the modem.

HTH

Rick

[cadet alain]

Hi,

To add to Richard's explanation, you could keep the same addressing on inside and outside using the ASA in transparent mode but if your modem is the DHCP server then you'll have to configure ACLs and apply them on inside and outside interfaces to let the DHCP requests and replies go through the appliance.

Regards

Alain

[JohnDbury71]

I don't want the modem to be DHCP server but even if I execute the command "dhcpd address 192.168.1.10-192.168.1.40 inside", the ASA doesn't do anything.

When I deactivated the DHCP functionality from my modem, I had an IP like 169.41.x.x...

If I could have my modem just as a gateway, it would be perfect.

[Richard Burts · Accepted solution]

John

Depending on the model of the modem and the policies of the provider you might be able to change the modem configuration so that it does become a simple gateway to the Internet. Or you might need to work around what the modem is doing by changing the configuration of your ASA.

As I explained in my previous post the biggest issue is the choice of 192.168.1.0 as your inside network. Your inside network needs to be something different from the outside network, which is 192.168.1.0 unless the provider gives you the option to configure it to use something different. So the easy thing to do is for you to choose a different inside network. 192.168.2.0 should work just fine. And 10.0.0.0/24 would also work.

HTH

Rick

[JohnDbury71]

Thank you. I followed your advice. I can reach the 10.0.0.1 if I force my IP to be in this network but by DHCP I get an IP address like 192.168.1.x. So it seems that the modem is giving an IP.

I can't access to the Internet either. The ASA should be send me an IP address right ? Why doesn't it work ?

Here is my config :

ASA Version 8.2(5)

!

hostname Cisco-ASA-5505

enable password 8Ry2YjIyt7RRXU24 encrypted

passwd 2KFQnbNIdI.2KYOU encrypted

names

!

interface Ethernet0/0

switchport access vlan 2

!

interface Ethernet0/1

!

interface Ethernet0/2

!

interface Ethernet0/3

!

interface Ethernet0/4

!

interface Ethernet0/5

!

interface Ethernet0/6

!

interface Ethernet0/7

!

interface Vlan1

nameif inside

security-level 100

ip address 10.0.0.1 255.255.255.0

!

interface Vlan2

nameif outside

security-level 0

ip address 192.168.1.254 255.255.255.0

!

ftp mode passive

pager lines 24

logging asdm informational

mtu inside 1500

mtu outside 1500

icmp unreachable rate-limit 1 burst-size 1

no asdm history enable

arp timeout 14400

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0

route outside 0.0.0.0 0.0.0.0 192.168.1.1 1

timeout xlate 3:00:00

timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02

timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00

timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00

timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute

timeout tcp-proxy-reassembly 0:01:00

timeout floating-conn 0:00:00

dynamic-access-policy-record DfltAccessPolicy

aaa authentication ssh console LOCAL

http server enable

http 192.168.1.0 255.255.255.0 inside

no snmp-server location

no snmp-server contact

snmp-server enable traps snmp authentication linkup linkdown coldstart

crypto ipsec security-association lifetime seconds 28800

crypto ipsec security-association lifetime kilobytes 4608000

telnet timeout 5

ssh 192.168.1.0 255.255.255.0 inside

ssh 10.0.0.0 255.255.255.0 inside

ssh timeout 5

console timeout 0

dhcpd address 10.0.0.10-10.0.0.40 inside

!

threat-detection basic-threat

threat-detection statistics access-list

no threat-detection statistics tcp-intercept

tftp-server inside 192.168.1.42 /srv/tftp/cisco-rtr-01-config

webvpn

username admin password 4RdDnLO1w29lihWc encrypted

!

!

prompt hostname context

no call-home reporting anonymous

Cryptochecksum:3b61612a25ae3e376b2d7dafc627d96b

: end

[Richard Burts]

John

Try adding the command dhcpd enable inside and let us know if it works better.

Also I notice this in the config

tftp-server inside 192.168.1.42 /srv/tftp/cisco-rtr-01-config

I am not sure where this comes from but it appears to reflect the original environment where you were trying to use 192.168.1.0 as the inside network. It probably needs to change to reflect the current use of 10.0.0.0/24.

HTH

Rick

[JohnDbury71]

Thank you Richard, it seems that my PCs are getting an IP address from the ASA.

But when I try to go to a website, I get the error message : unknown address. I think it's because my DNS servers are defined on the modem (We use the ISP's DNS). So should I copy the IP addresses of primary and secondary DNS from ISP and write them for the ASA ? Do you know how can I do that please ?

An other thing is about static IP address. How can I give the same address from the DHCP pool to a MAC address ?

Thanks

John

[cadet alain · Accepted solution]

Hi,

An other thing is about static IP address. How can I give the same address from the DHCP pool to a MAC address ?

You can't do manual binding for DHCP on an ASA

But when I try to go to a website, I get the error message : unknown address.

You should configure your ISP DNS servers in your DHCP configuration on the ASA with the global config dhcpd dns command

Regards

Alain 

Don't forget to rate helpful posts.

[JohnDbury71]

These commands made it work :

dhcpd dns interface inside

dhcpd update dns both override interface inside

Thanks for your help !

[cadet alain]

Hi,

are the hosts getting these DNS servers? ---> ipconfig/all

can you do a nslookup google.com  on a host and post the output

EDIT: glad you could make it work

Regards

Alain

Don't forget to rate helpful posts.

Ce message a été modifié par: cadet alain