topic Re: CIsco ASA before main router in Network Security

CIsco ASA before main router

polandlp — Thu, 21 Mar 2024 18:06:14 GMT

Hello I want to setup my cisco asa before my main router. I like to filtrate incoming ports. I like to enable transparent mode and configure as transparent firewall(I know all limitations of it) i set up all things but What IP i must add to bvi bridge when for example my main router get ip (from isp dhcp server): 1.1.1.56/24
Main router is my connection between WAN(ISP)-LAN it is doing nat and other things

Re: CIsco ASA before main router

Rob Ingram — Thu, 21 Mar 2024 18:10:44 GMT

@polandlp in transparent mode, the IP address assigned to the BVI would be an IP address in the same subnet as the bridge group member interfaces - in your case 1.1.1.x/24

Re: CIsco ASA before main router

MHM Cisco World — Thu, 21 Mar 2024 18:11:08 GMT

Bvi must have IP in Same subnet of 1.1.1.56/24.

MHM

Re: CIsco ASA before main router

polandlp — Thu, 21 Mar 2024 18:13:28 GMT

If my router received an IP from an ISP in BVI, would I have to set the same IP as the router would receive?

Re: CIsco ASA before main router

Rob Ingram — Thu, 21 Mar 2024 18:14:56 GMT

@polandlp it cannot be the same IP address as the router, it must be a different IP address in the same network.

Re: CIsco ASA before main router

polandlp — Thu, 21 Mar 2024 18:17:00 GMT

ok, but when i set diferent address ip it can destroy something in isp network?

Re: CIsco ASA before main router

polandlp — Thu, 21 Mar 2024 18:18:34 GMT

can you explain what is that ip used for?

Re: CIsco ASA before main router

MHM Cisco World — Thu, 21 Mar 2024 18:28:03 GMT

Why?

Image there are two L3 device (router and ISP) connect to one SW' and SW have VLAN SVI IP.

It work there are no problem.

Bvi have different IP than router and all three ISP' router and BVI in same subnet

MHM

Re: CIsco ASA before main router

Rob Ingram — Thu, 21 Mar 2024 18:40:57 GMT

@polandlp you cannot arbitrarily assign an IP address to the BVI, the routed network between you and the ISP must have a spare IP address for you to assign otherwise it will conflict. If for example you have a /30, one IP address used by your equipment and the other by the ISP, then there are no free IP addresses for you to use for the BVI IP.