topic Help!! configuration in Network Security

Help!! configuration

omer_babiker — Tue, 12 Mar 2019 00:06:57 GMT

Hi All,

my current network layout is attached.

The service provider will be preparing an MPLS-VPN network as per our request.

The required scenario is:

Only one PC from the 10.50.10.0/24 subnet is required to connect to mpls network directly. Other PCs should remain the same.

Is that possible? if yes, what configuration that can be done?

Note: PCs of the 10.50.10.0/24 subnet got the ip addresses from dhcp server which managed by other department (same building), and they can cooperate.

Please advise.

Help!! configuration

Harish Balakrishnan — Wed, 10 Oct 2012 06:38:05 GMT

Hello Omer,

You meant to say only 1 PC at a time or a specific defined PC but the IP address may change since it is DHCP

regards

Harish.

Help!! configuration

omer_babiker — Wed, 10 Oct 2012 06:42:18 GMT

Hi Harish,

It is specific defined PC but ip address may change.

Regards,

Help!! configuration

Harish Balakrishnan — Wed, 10 Oct 2012 06:44:09 GMT

Hello Omer,

thanks for the info.. What type of firewall are you using and the OS version if it is Cisco

regards

Harish

Help!! configuration

omer_babiker — Wed, 10 Oct 2012 06:48:20 GMT

Hi Harish,

It's ASA5510, and the version is 8.0 (4).

Thanks,

Help!! configuration

Harish Balakrishnan — Wed, 10 Oct 2012 07:05:26 GMT

Hello Omer,

In Normal routed mode ASA, there is no native way of mac filtering. If you want the client to access http/ftp/telnet traffic through MPLS, then you can use cut through proxy and give mac excemption for you specific PC..

If that solution in place, it will ask for an authentication if other PC's trying to access and the pc with mac excemption configred will bypass the authentication and can access

the following link provide you information on the solution

http://hanlinag.blogspot.com/2011/10/how-to-block-out-going-traffic-by-mac.html

Harish.

Help!! configuration

omer_babiker — Wed, 10 Oct 2012 07:20:31 GMT

Hello Harish,

Thank you so much for your help.

do you think it's possible to define static ip address for that specific PC?

If that possible, the traffic from that pc can easily be routed to go to mpls network. please correct me if I'm wrong.

Regards,

Help!! configuration

Harish Balakrishnan — Wed, 10 Oct 2012 07:28:39 GMT

Hello Omer,

Thant is the ideal solution,, give the static IP for that PC and exclude that IP in DHCP server..

Create ACL in ASA so that only that IP is permitted to MPLS network and deny complete subnet to MPLS network as second line and permit ip any any as the third line of the ACL

regards

Harish.