topic Re: ASA connected to 3750 (Layer 3 Switch) in Network Security

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Tue, 12 Mar 2019 01:30:59 GMT

I have a an ASA 5520 connected to a Layer 3 (3750) switch (Inside) and a connection to a 2960 switch (Outside) to get to the internet. . I have created vlan interfaces on the 3750 switch and enabled ip routing on the switch to enable the vlans to communicate with each other.

Vlan Interfaces on the switch:

Vlan 100 172.17.1

Vlan 200 172.18.1

Vlan 300 192.168.3.1

I want the devices connected to the 3 vlans to be able to pass through the firewall and get out to the internet.

Question:

I have connected the ASA to the 3750 by routed interfaces (10.10.10.1) --------- (10.10.10.2) and they are able to ping each other.

I have also put a default route on the 3750 sending all traffic from the switch to the ASA inside interface (10.10.10.1)

The issue that i am having is that the ASA also connects to a 2960 which has a connection to the Internet, and they are handing off an ethernet connection from the 2960 that sits in VLAN 55 (Vlan 55 is the Internet accessible vlan).

How do I configure my ASA to send all traffic from my (3) vlans to the interfaces that connects to the 2960 switch?

Re: ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Thu, 18 Apr 2013 13:31:48 GMT

Hi,

Since you are already doing Inter-Vlan routing on the L3 Switch I would suggest configuring a new Vlan that is only configure to provide a link/connectivity between the ASA and the LAN networks.

Naturally it would be good if the ASA itself was acting as the L3 point of the network but naturally it doesnt have to be. Though you will not be able to control traffic between the LAN networks. Though the ASA5520 model might run into performance problems also if the L3 point was on the ASA. This depends on the amount of traffic between the LAN networks.

I would suggest configuring something like this. The specific configuration/addresses/Vlan id/Port ID depends naturally on your current configurations on the devices.

L3 Switch

vlan 10

name Link to ASA

interface Vlan10

description Link to ASA

ip add 10.10.10.2 255.255.255.0

ip route 0.0.0.0 0.0.0.0 10.10.10.1

interface GigabitEthernetx/x

description Link to ASA

switchport mode access

switchport access vlan 10

switchport nonegotiate

spanning-tree portfast

no shutdown

ASA

interface GigabitEthernet0/1

description Link to Core

nameif inside

security-level 100

ip add 10.10.10.1 255.255.255.0

route inside 172.17.1.0 255.255.255.0 10.10.10.2

route inside 172.18.1.0 255.255.255.0 10.10.10.2

route inside 192.168.3.0 255.255.255.0 10.10.10.2

For other ASA configurations like NAT and ACLs I would have to see the current ASA configuration.

Hope this helps

- Jouni

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Thu, 18 Apr 2013 13:46:36 GMT

Jouni thank you so much for your response!!!

I am replacing a SOHO firewall that is currently connected that only allows one subnet (Vlan) out to the Internet, according to the previous engineer.

So for the traffic going to the internet I would put a nat statement for the 3 vlans to the outside interface?

Thanks

Desmond

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Thu, 18 Apr 2013 13:50:34 GMT

Hi,

Are you saying that you have another device connected to the L3 Switch that is currently handling Internet traffic? You already have a default route pointing to another device?

- Jouni

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Thu, 18 Apr 2013 13:58:55 GMT

Sorry for the confusion.

The current setup has a 3750 switch connected to a Linksys SOHO router that is handling traffic for the Internet

Currently, this set up only allows one of my vlans to access the Internet.

I am replacing the Linksys device with an ASA 5520 and I want all 3 of the vlans to have Internet access which is the reason for the replacement. I hope I am explaining this with some clarity.

Thanks,

Desmond

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Thu, 18 Apr 2013 14:07:55 GMT

Do you plan to make this change gradually or do you simply want to prepare the ASA configuration for the complete replacement of the Linksys and then do the change?

There might be a possibility to for example do Policy Based Routing on the 3750 for the 2 Vlans that dont have Internet access and forward all their Internet bound traffic to the ASA while still leaving the 1 Vlan to use the Linksys.

This would let you test the Internet through the ASA while still having the original Internet connection.

I am not sure how the Policy Based Routing (PBR) will affect the 3750 performance. I have had one occasion where it caused slight problems with the performance of the device.

What will the ASA use for Internet connection? Does it have a new Internet connection OR will the current Linksys connection be changed to provide the connection to the ASA and the ASA would then handle the firewalling etc.

Hopefully I made sense

- Jouni

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Thu, 18 Apr 2013 14:35:44 GMT

Jouni,

I am actually looking just to replace the older, less featured device with a new ASA 5520.

The ASA 5520 will replace the Lnksys so the same currently used connections will also be used for the ASA connection..

I am usisng the ASA to firewall off my new created network from the other production network they have in place.

Thanks,

Desmond

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Thu, 18 Apr 2013 14:52:37 GMT

Ok,

So I guess you just have to make sure that he L3 Switch is configured with the new link to the ASA and the default route is configured to point to the ASA "inside" interface IP address so that all traffic not destined for the LAN networks is forwarded to the ASA.

The ASA should be configured with the basic settings

Configure one ASA interface as the one facing the ISP with the public IP address
Default route towards the ISP gateway IP
Configure one ASA interface as the "inside" interace towards the L3 Switch
Configure basic Dynamic PAT translation for all the 3 Vlan networks on the L3 Switch
Configure routes on the ASA for all the 3 Vlan networks pointing to the IP address on the new link network located on the L3 Switch
Allow traffic with ACL on the "inside" interface
Possibly configure "fixup protocol icmp" to enable ICMP Echo/Echo Reply to get through the ASA for testing purposes
etc

- Jouni

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Thu, 18 Apr 2013 15:45:30 GMT

Jouni thank you for all of your assistance with this issue, I am confident that I will get this up and running with the assistance you provided!

Thanks again!

Desmond

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Thu, 18 Apr 2013 16:47:21 GMT

No problem

Can you please mark the question as answered (button in the reply message) or rate the reply.

Naturally ask more if the need arises.

- Jouni

ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Fri, 19 Apr 2013 15:22:16 GMT

Jouni I need you assistance once again.

I just got to the site and set up the asa, but the configuration has changed a bit.

The ASA inside interface is connected to a 3750 switch by the routed connection that you suggested on yesterday and I am able to ping the 3750 from the ASA but the outside interface of the ASA is connected to a 2960 switch that is handing off a connection to the VLan 55 that they are stating is the only VLan that has access to the Internet.

How would I then configure the ASA to send traffic to the outside interface that has no ip address?

Thanks in advance.

Desmond

Re: ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Fri, 19 Apr 2013 17:04:13 GMT

Hi,

Did you edit the original post?

But anyway, I am not sure I understood correctly but seems to me that the LAN portion + ASA is possibly configured fine (Have not seen the configurations so cant say for sure)

Now if your Internet connection from the ISP is provided through a 2960 switch and its has a Access mode port on Vlan55 towards the ASA then naturally you just connect that port to the ASA "outside" interface.

You say that you dont know how to route the traffic to the Internet from the ASA. To me it seems that there is only 2 options. You either have to know the ISP gateway IP address to which you configure the default route on the ASA OR if the previous Internet router was using DHCP to aquire the public IP address (and default route) from the ISP, then you will have to configure the ASA to also use DHCP on its outside interface.

But again, I am not all that sure on how the ASA and the switch on the "outside" is configured so its impossible to say what the situation is and give specific instructions.

- Jouni

Re: ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Fri, 19 Apr 2013 17:55:58 GMT

Jouni!!!

Yes I did edit it with my new issues.

I have attached the config if you want to take a quick look.

I have the interface labeled and the Gi0/2 is connected to the 2960. I have also added a subinterface for the Vlan configuration, not sure if that was correct or not.

Thanks,

Desmond

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Fri, 19 Apr 2013 18:22:16 GMT

Hi,

Do you have access to the 2960 switch?

To be honest if you have been originally assigned a public IP address range or a static public IP address then you should be able to get that information either from the old device or directly from the ISP.

If the old device was getting the public IP address from the ISP with DHCP then you will have to use DHCP on the "outside" interface.

If you have already replaced the old Linksys Internet router would it be possible that you could check its configurations to see how its WAN interface is configured. This would tell us how we need to configure the ASA "outside" interface. IF indeed the ASA will use the same line to Internet as the old Internet router/device was using.

I dont think you need to configure a subinterface on the ASA. IF the 2960 has a Access port towards your ASA you can simply connect the ASA Gi0/2 to that 2960 Access port. Provided that switch has a connection to ISP.

- Jouni

Re: ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Fri, 19 Apr 2013 18:39:33 GMT

I just had someone check the 2960 port that connects to my ASA and it is just an access port that is in the 55 vlan.

I thought it may have been set up differently but its just an access port.

That being the case, Vlan 55 is the only vlan that can access the internet. Is there soemway I can take 172.172.1.0 Vlan (for example) and nat it to the VLAN 55?

I dont know I am just throwing out things...

ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Fri, 19 Apr 2013 19:44:24 GMT

Hi,

I think I already posted an answer but I cant see it in this discussion for some reason. Dont know what happened.

I am still not clear what the Vlan55 is. It sounds to me from your comments that it would just be another user Vlan?

Or is it the Vlan between your side and ISP?

What IP address range does the Vlan55 use?

What is that network using as its default gateway since you say it can access Internet?

Isnt this Vlan55 behind the ASA on the 3750 or does it only exist on the 2960 switch?

- Jouni

Re: ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Fri, 19 Apr 2013 20:45:16 GMT

Hi Jouni,

Vlan 55 is a vlan that exist only on the 2960 and does not extend past the firewall, they are only handing an Ethernet connection off to my ASA which is in Vlan 55.

The IP address range of vlan 55 is 10.63.210.128/25 and the gateway of that vlan is 10.63.210.129. Since that is a private IP address range I am assuming it is getting natted again to a public IP address space.

Desmond

Re: ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Fri, 19 Apr 2013 21:15:45 GMT

Hi,

Is there any specific reason this Vlan55 is separate from all the other Vlans?

So I guess next we could do the following steps (Presuming the ASA is still configured like in your previous posted configuration)

Remove the Subinterface

no interface Ethernet0/2.1

Aquire an IP address for the ASA

Unless you manage the Vlan55 address space you will have to ask someone to give an IP address from the Vlan55 network that you can configure on the ASA "outside" interface. When you get that IP address use it with the below configuration.

interface Ethernet0/2

description Link to 2960

nameif outside

security-level 0

ip address 10.63.210.xxx 255.255.255.128

Define a default route

We will route all traffic to networks that are not local to the default gateway of Vlan55. Which I presume holds the Internet connectivity

route outside 0.0.0.0 0.0.0.0 10.63.210.129

Define NAT0 / NAT Exempt for the LAN networks behind ASA

As the Internet connection isnt directly connected to the ASA "outside" interface there is no need to NAT the LAN networks. So we will configure the below NAT0

access-list INSIDE-NAT0 remark NO NAT for LAN networks Behind ASA

access-list INSIDE-NAT0 permit ip 192.168.162.0 255.255.255.0 any

access-list INSIDE-NAT0 permit ip 192.168.3.0 255.255.255.0 any

access-list INSIDE-NAT0 permit ip 172.17.1.0 255.255.255.0 any

nat (inside) 0 access-list INSIDE-NAT0

Add ICMP Inspection on the ASA

This will help allowing ICMP traffic through the ASA if you are testing something with ICMP. Naturally we have to consider that there is other device controlling Internet traffic so it might prevent something.

policy-map global_policy

class inspection_default

inspect icmp

inspect icmp error

Request that route for the 3 LAN networks are routed from the Internet router/device towards the ASA outside IP address

We need the Internet Router/device to know where your LAN networks recide since we are not doing any NAT for the 3 LAN networks

Request that the Internet Router/device is configured with NAT rules which will allow the 3 LAN networks behind the ASA to be NATed towards Internet

We need the Internet Router/device also to have NAT rules on it for your 3 LAN networks so they will get NATed to a public IP address to enable Internet connectivity.

Also one optional thing you can try which DOESNT require any configurations on the Internet Router to my understanding.

First you will need some IP address from the Vlan55 that you know is free and not used by any device. You then configure the "outside" interface just like in the above example. You also configure the default route just like above.

But instead of NAT0 you configure PAT for the 3 LAN networks

global (outside) 1 interface

nat (inside) 1 192.168.162.0 255.255.255.0

nat (inside) 1 192.168.3.0 255.255.255.0

nat (inside) 1 172.17.1.0 255.255.255.0

What this will do is PAT all the traffic from the 3 LANs to the "outside" ip address of the ASA. As that IP address is part of the Vlan55 network it probably means that it has all the necesary configurations on the Internet Router/device and you potentially will be able to access Internet.

Even either of the above options work this is not an ideal setup. It would be best if the actual public IP address (or range/subnet) was configured directly on the ASA rather than some other device. And also that the Vlan55 was behind the ASA. Perhaps as its own interface if it needs to be kept separate by the other 3 LAN networks by the firewall.

But to my understanding the main priority is to get Internet connectivity.

Whew, finally done with the writing.

- Jouni

Re: ASA connected to 3750 (Layer 3 Switch)

Desmond Smith — Fri, 19 Apr 2013 21:31:02 GMT

Jouni if you were here I would have to bear hug you dude!!!

First, I thank you for the assistance and the explanation of why this is being done. I will try your configuration suggestions on Monday or Tuesday and let you know what the results are. I am trying to get a better grasp of security as I want to go deeper in the field of study as I gain more knowledge of the Cisco security devices. You sound like you have a wealth of knowledge in the field of security and I hope I can one day gain that level of knowledge and expertise...Is that self taught or professional training?

Desmond

Re: ASA connected to 3750 (Layer 3 Switch)

Jouni Forss — Fri, 19 Apr 2013 21:41:42 GMT

Hi,

Basically when I was studying 2002-2007 I only covered the Ciscos CCNA and CCNP material for Routing&Swithing. I decided to do my Final work / Bachelors Thesis on building a small business network with Cisco Firewalls/Routers/Switches.

I was completely clueless with regards to firewalls as we didnt have any courses related to Cisco firewalls.

After I graduated I got to work at my local ISP and there quickly found myself configuring Firewall/VPN environments. I would say 99% of what I know are a result of simply learning from my colleagues and simply testing and going through existing configurations. Naturally all the documentation on the Internet/Cisco site are valuable also.

I would still say that you learn the most by just doing and when you run into some problem you usually learn even more since you really need to determine what is happening and how everything works.

Courses only get you so far. Typically the courses I have gone into try to cram way too much content into short amount of time and not enough lab practices which ends up with the result that you end up forgetting the information unless you can directly apply the course contents in your work right away.

- Jouni