topic thanks Vobhor for your quick in Network Security

How can we allow internal users to access internet through ASA firewall?

m.venkatesa — Tue, 12 Mar 2019 05:37:42 GMT

Hello,

I am new to security track, i have been asked to setup lab and allow users from inside firewall to access internet. here is my lab setup

PC -> switch 1 (layer2) -> (inside) ASA (outside) -> switch 2 (Layer2) -> Router

does switch 2 port needs internet access through router?

what configuration required on ASA to allow users behind the firewall to access internet?

any help on this would be much appreciated.

thanks,

Hi,I think it would be easier

Vibhor Amrodia — Thu, 12 Mar 2015 01:12:20 GMT

Hi,

I think it would be easier if you give us the related configuration so that i can suggest the required changes.,

These are the things which you would need:-

1) Dynamic NAT

2) Default Route

Thanks and Regards,

Vibhor Amrodia

I have basic configurations

m.venkatesa — Thu, 12 Mar 2015 01:30:32 GMT

I have basic configurations like

hostname(config)# nat (inside) 1 0 0
hostname(config)# global (outside) 1 interface

hostname(config)#route outside 0.0.0.0 0.0.0.0 <router interface>

I am able to ping from PC to Router IP and i can ssh to outside interface of Firewall.

thanks

Hi,I think this configuration

Vibhor Amrodia — Thu, 12 Mar 2015 01:39:48 GMT

Hi,

I think this configuration seems good. Are u not able to browse internet through this ASA device ?

If yes , provide me this output:-

packet input inside tcp <PC IP address on the inside> 3456 8.8.8.8 80 det

Thanks and Regards,

Vobhor Amrodia

thanks Vobhor for your quick

m.venkatesa — Thu, 12 Mar 2015 01:56:26 GMT

thanks Vobhor for your quick response

I cannot browse internet through firewall. i did connect my PC directly to switch 2 port without firewall and i cannot access internet. will that be an issue? do we need to have internet connectivity through switch2 in order to allow users behind the firewall?

thanks

Hi,Okay , can you clarify on

Vibhor Amrodia — Thu, 12 Mar 2015 10:12:05 GMT

Hi,

Okay , can you clarify on this for me. Are you able to ping the internet from the ASA outside interface ?

Just try something like this:-

ping 4.2.2.2 .. Does this work ?

If this does not work , then i think the ASA even is not able to get to the internet and that would be a problem on the router.

Also , internet from Switch 2 is not a requirement as that is only a Layer 2 device.

You can assign the ISP allocated address on the PC , connect it to the Switch 2 port and then try to ping something on the internet or surf internet and i think that should work.

Thanks and Regards,

Vibhor Amrodia

Its working, i seems i need

m.venkatesa — Thu, 12 Mar 2015 15:38:26 GMT

Its working, i seems i need to add DNS entries on my PC to browse internet. is there a way we can make get this informations from gateway/firewall when we connect PC to firewall inside interface without manually enter on every PC?

thanks

Hi,What you need is a DHCP

Adeolu Owokade — Fri, 13 Mar 2015 01:42:10 GMT

Hi,

What you need is a DHCP server. If you don't have a dedicated DHCP server, you can consider enabling it on your ASA (or switch if it supports it).

http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/guide/config/dhcp.html#wp1114099

Re: Hi,What you need is a DHCP

mahendarec@123 — Thu, 10 Feb 2022 09:26:53 GMT

Above cisco link is not opening, please provide the working link and help.