topic I looked at the switch setup in Network Security

ASA 5505 adding subnets

ken.hoover1 — Tue, 12 Mar 2019 07:11:57 GMT

I am about to add 10 sub-nets and 6 virtual servers to my domain. I have an ASA 5505 firewall version 7.2 with a basic license. Do I need to add the VLANS to the firewall or add them in interfaces? I am new to the whole firewall rules thing and would appreciate any help I can get.

Thanks

ASA 5505 with the Base

Karsten Iwen — Wed, 27 Jan 2016 20:32:41 GMT

ASA 5505 with the Base-license only supports two full-featured Vlans. With that you can't configure these new subnets as firewall-interfaces and do filtering between these VLANs.

You still can configure these subnets on a layer3-switch that gets connected to the ASA. But still no firewalling between these subnets.

If really want to separate these networks, then you need a bigger firewall. For the ASA, that starts with the 5506-X with the SecurityPlus license.

These sub-nets are configured

ken.hoover1 — Wed, 27 Jan 2016 20:48:35 GMT

These sub-nets are configured on the HP 2920 switches, so will they be firewalled? Also, would the sub-nets still be able to access the Internet for updates?

These subnets can communicate

Karsten Iwen — Wed, 27 Jan 2016 21:16:28 GMT

These subnets can communicate to the Internet, this traffic can be firewalled. But all traffic between the subnets on the switch stays local to the switch without going through the ASA.

Just so I know I understand

ken.hoover1 — Wed, 27 Jan 2016 21:40:13 GMT

Just so I know I understand correctly, if the switch is plugged into the network, these sub-nets are firewalled the same as the network? Or do I need to add rules to protect them as well?

All networks "live" on the

Karsten Iwen — Wed, 27 Jan 2016 21:44:43 GMT

All networks "live" on the inside interface of your ASA. If you want to control how they are allowed to connect to the internet, you need to configure that on the inside ACL and make sure that these networks are also address-translated.

If these networks should be reached from the internet, you need to allow this on the outside ACL and also configure static translation for them.

And you need to add static routes to your ASA for these networks pointing to the L3-switch.

I looked at the switch setup

ken.hoover1 — Mon, 01 Feb 2016 21:44:32 GMT

I looked at the switch setup and I do not see where to configure that on the inside ACL. Also can this be done through the ASDM or do I need to use CLI?