topic Re: install transparent asa into existing network with public ip in Network Security

install transparent asa into existing network with public ip's

Carlomd — Tue, 12 Mar 2019 02:59:21 GMT

Hi all, I'm trying to find the best approach on getting my ASA to replace our Juniper, we have public ip's from our isp and it's set to nat the gateway and mip the inside ip's to outside public ip's.

I tried hooking up the asa into the leased router, added my inside rules to be accessed outside but not able to get to the web or ping, I read that nat is not needed on the ASA in transparent mode though it's possible, but in my setup with our isp I may need to use nat or could I go away with it, what would be my best option to get this setup, any samples or links would be great.

Thanks,

Carlo

install transparent asa into existing network with public ip's

jumora — Sun, 03 Nov 2013 02:36:28 GMT

What version are you using on the ASA?

Do you know how transparent firewall works?

What is the function that the juniper takes in your network?

FYI: It would be best to address this wih a design team

install transparent asa into existing network with public ip's

Carlomd — Sun, 03 Nov 2013 20:10:03 GMT

What version are you using on the ASA?

It's got asa 9.1

Do you know how transparent firewall works?

Yes but I'm pretty novice at networking since I take on a few things besides networking at my work, I set it up about 5yrs ago and kinda out of practice now, the difference with this and juniper, the juniper's trust and untrust int has different ip's, the untrust has our public ip and trust has internal and nat'd, where the asa has one ip for the inside and outside, but the same bump in the wire right.

What is the function that the juniper takes in your network?

The Juniper ns25 is in transparent mode(interestingly I looked at the juniper's trust and untrust it shows it's a layer3 as where from what I read about the asa in transparent mode is a layer2)

I found this article here that could be similar to my scenario and I need to read up on it, I think nat needs to be setup similar to the juniper over to the asa to map the outside public ip to internal ip of our gateway, there was a converter I found here but it wouldn't take my juniper config, worst comes to worst I'll open a tac ticket to see if they can convert the juniper to asa, I'm just avoiding having to redo my internal ip's -

https://supportforums.cisco.com/docs/DOC-31116

install transparent asa into existing network with public ip's

jumora — Sun, 03 Nov 2013 20:54:22 GMT

Actually read the next:

http://www.cisco.com/en/US/docs/security/asa/asa91/configuration/firewall/nat_overview.html#wp1107431

install transparent asa into existing network with public ip's

jumora — Mon, 04 Nov 2013 20:43:26 GMT

FYI: TAC does not have a tool to convert from Juniper firewall to Cisco ASA.

install transparent asa into existing network with public ip's

Carlomd — Mon, 04 Nov 2013 21:17:30 GMT

Thanks for the link and Tac info, I'm reading up on the transparent nat setup.

install transparent asa into existing network with public ip's

Carlomd — Tue, 05 Nov 2013 00:19:42 GMT

Hi, so I read the docs, now my question, on our old firewall the gateway we used was the one set on the nat'd trust int, and the public ip gateway of the router is untrust, so on the asa I just create a static nat for the public gateway nat'd to an internal ip that can be used as the gateway -

nat (inside,outside) static mygateway, then we could still use the old gateway we always had right?

install transparent asa into existing network with public ip's

Julio Carvajal — Tue, 05 Nov 2013 00:33:10 GMT

Hello,

I am not sure about your last question but let's give it a try

Is the firewall going to run on transparent or Routed mode?

If it's on transparent then you will need to assign an IP address to the ASA for management purposes but the IP subnet between the inside users and the untrust gateway should be the same.

That being said if you want the ASA to run on L3 mode (splitting the broadcast-domain) then you just need to set a default route on the ASA poiting to the untrust gateway (Outside Modem) and on the inside PCs the ASA as the default gateway.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

install transparent asa into existing network with public ip's

jumora — Tue, 05 Nov 2013 00:33:48 GMT

Sorry I did not get the concept, maybe if you could explain this a bit better.

install transparent asa into existing network with public ip's

Carlomd — Tue, 05 Nov 2013 00:41:56 GMT

Hi Julio thanks for replying, the asa5510 is already set for transparent mode, with management int set, I had it set in a lab for testing, but its when I tested on the actual connection from isp, it wasn't allowing ping or web, so I may just need to add a route, I thought I read somewhere that transparent mode doesn't support routing, I'll give it a try, thanks

install transparent asa into existing network with public ip's

Julio Carvajal — Tue, 05 Nov 2013 00:50:50 GMT

Sure,

It does need a route for special Purposes (Managment, Syslog, AAA, To know where to forward packets where it does not have a valid MAC address entry)

So add it pointing to the Outside gateway (Remember inside and outside interface must be on the same subnet.

Rate all of the helpful posts!!!

Regards,

Jcarvaja

Follow me on http://laguiadelnetworking.com

install transparent asa into existing network with public ip's

Carlomd — Tue, 05 Nov 2013 00:51:01 GMT

Jumora, here's a sample setup -

old firewall (untrust = 12.1.1.1) ip of leased router (this was the outside ip gateway I think I can't see in the router since it's not managed by us, but it's nat'd to our internal gateway ip) >(trust = 101.2.2.2) this is our internal gateway ip

that's the current setting in the juniper

so on the asa, the new config for nat would be

nat (inside,outside) static mygateway - then we can still use 101.2.2.2 as gateway, I think this is what I'm missing to get an open connection to the outside.

install transparent asa into existing network with public ip's

Carlomd — Tue, 05 Nov 2013 00:53:57 GMT

Julio, yes the inside and outside are in a bvi group with internal ip and same subnet.

install transparent asa into existing network with public ip's

Carlomd — Tue, 05 Nov 2013 01:03:42 GMT

Julio I think your right on the route setting, it's been a while since I configured the juniper, I looked at the juniper route setting, the outside ip routes to our internal network.

install transparent asa into existing network with public ip's

jumora — Tue, 05 Nov 2013 01:27:22 GMT

I get you, yeah NAT, go for it so that the upstream router can add it to the ARP table. Also add the routes that Julio mentioned for routing.

Re: install transparent asa into existing network with public ip

Carlomd — Wed, 06 Nov 2013 17:36:51 GMT

Hi guys, so I went and put my route to outside pointing to my isp's router gateway as well as nat, but somehow I can't ping, here's my edited run-config. Let me know what I'm missing, thanks.

Re: install transparent asa into existing network with public ip

jumora — Wed, 06 Nov 2013 18:37:27 GMT

Give me logs I need to see logs to see what is the ASA indicating.

Re: install transparent asa into existing network with public ip

Carlomd — Wed, 06 Nov 2013 19:23:58 GMT

here's my sh logging output, can't get the whole log to show in putty, but these are focused on the bvi int, it seems to show a bunch of errors or teardowns that I also see when looking at asdm latest syslog message. I added a simple network topology diagram. Any help would be great

Re: install transparent asa into existing network with public ip

Carlomd — Thu, 07 Nov 2013 17:04:36 GMT

We're you able to look into my logs, is there any other way to see what's happening in the traffic inside the asa besides logs.

Re: install transparent asa into existing network with public ip

jumora — Thu, 07 Nov 2013 19:20:05 GMT

What address where you trying to reach??