topic Re: Help me configure my ASA5505 in Network Security

Help me configure my ASA5505

Svetoslav Simeonov — Sat, 22 Jun 2019 12:54:15 GMT

Hello guys,

Please help me to configure my ASA5505 with a router cisco 2900 series behind it. My toplogy is the following:

internet -> ASA5505 -> Cisco 2900 -> Switch

internet -> 10.1.1.1 -> 192.168.100.1 ->Switch

When I connect a computer behind the ASA5505 directly I have internet on it.

When I connect a computer behind the Cisco 2900 Router I don't have internet, but can ping 10.1.1.1.

Can you give me advice how to configure the ASA5505 that I have internet on the Cisco Router?

Thank you.

Re: Help me configure my ASA5505

Rob Ingram — Sat, 22 Jun 2019 13:50:47 GMT

Hi,
So does the 2900 router have a default route pointing to the inside interface of the ASA?
Does the ASA have a route to the networks behind the router pointing to the IP address of the 2900 router?
If NAT configured for the network you are trying to access the internet from?

If you provide the configuration of the devices we can determine where the issue is.

HTH

Re: Help me configure my ASA5505

Svetoslav Simeonov — Sat, 22 Jun 2019 13:53:01 GMT

Hey,

I will provide the configurations at the end of next week. The Cisco router does not have default route set, because im not sure how to add it. Inside the asa I have set the route to Cisco Router.

Re: Help me configure my ASA5505

Rob Ingram — Sat, 22 Jun 2019 14:00:26 GMT

If the router does not have a default route set, then traffic would not be routed to the ASA. Here is an example to configure a default route on the router.

"ip route 0.0.0.0 0.0.0.0 192.168.x.x" - replace x.x with the correct IP address of the ASA's inside interace.

Re: Help me configure my ASA5505

Svetoslav Simeonov — Sun, 23 Jun 2019 10:28:54 GMT

And my other question is - do I need that Cisco 2900

Can I exclude it and use only the ASA5505 as a firewall and a router?

INTERNET -> ASA5505 -> Internal Network

I expect to have about 150-200 ips on the internal network.

Thank you.

Re: Help me configure my ASA5505

Rob Ingram — Sun, 23 Jun 2019 10:38:44 GMT

Hi,
Yes, you could just use the ASA, you would set the ASA's IP address as the default gateway of the computers.

HTH

Re: Help me configure my ASA5505

Svetoslav Simeonov — Sun, 23 Jun 2019 11:33:23 GMT

And what are the disadvantages of using only ASA? Are there any? Maybe security or slowness ?

Re: Help me configure my ASA5505

Rob Ingram — Sun, 23 Jun 2019 11:53:23 GMT

The ASA 5505 is End of life, if you have 150-200 connections behind the firewall it might impact performance.

No need to use the 2900 router.

You may wish to replace this firewall with the newer Firepower hardware, info here.

HTH

Re: Help me configure my ASA5505

Svetoslav Simeonov — Sun, 23 Jun 2019 11:57:32 GMT

Thank you for the answers. Do you think that a Mikrotik CCR1009-7G for example can handle the job to be a good firewall and a router? Thank you again RJI.

Re: Help me configure my ASA5505

Rob Ingram — Sun, 23 Jun 2019 12:05:49 GMT

It depends on your environment (large enterprise or small business or small home network) and what features you require. It seems more of a router than a firewall. A dedicated firewall will provide more security than a router, a firewall will also do routing.