topic Re: Guest network setup using ASA 5520 in Network Security

Guest network setup using ASA 5520

mbroberson1 — Fri, 21 Feb 2020 10:53:29 GMT

Looking into setting up a guest network. We would like to give a certain amount of our internet bandwidth to the guest network and setup DHCP on the ASA for the quest network. The guest network needs to be totally segmented from our corporate network.

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 01:54:21 GMT

Do you have a proxy server on your network?

You could create a separate zone/interface for the GUEST users giving it a lower security level as the inside. For DHCP have a look at:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00806c1cd5.shtml

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 10:57:35 GMT

We have a microsoft ISA server as our proxy server.

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 11:00:51 GMT

"We would like to give a certain amount of our internet bandwidth to the guest network"

I don't think the ASA supports this inherently. There are third party plug-ins for this tough.

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 11:05:53 GMT

So you can't throttle a port on the ASA?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 11:18:58 GMT

No you can actually, have a look at:

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/qos.html

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 11:23:51 GMT

So you can't throttle a port on the ASA?

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 11:59:00 GMT

So the configuration would be like to plug in from a switch port to the ASA port and set up DHCP for the ASA interface on the ASA and use QOS to port throttle the interface?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 12:14:28 GMT

Yup, you could throttle based on the DHCP pool you assign.

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 12:24:37 GMT

So the configuration I described looks accurate? Come out of the switch port that is assigned to the guest network vlan into the interface/port on the ASA that will be for the guest network. The ASA interface/port ip address will be the default-gateway for the clients correct?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 12:31:22 GMT

Yes the ASA will be the default gateway.

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 12:38:36 GMT

Looks like a easy configuration then?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Thu, 19 Jun 2008 12:47:58 GMT

Seems simple, but then that is a 'relative' thing 🙂

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Thu, 19 Jun 2008 12:54:10 GMT

Right...;-)

Thanks

Re: Guest network setup using ASA 5520

mbroberson1 — Fri, 20 Jun 2008 14:17:16 GMT

Would we need to configure a vlan on the ASA also to coin side with the vlan on the LAN?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Sat, 21 Jun 2008 06:57:28 GMT

You don't need to configure any vlans/sub-interfaces unless you require more zones than the interfaces built-in to your box (5).

You just choose any unused interface and set it up like this:

interface gig 0/2

no shut

nameif GUESTS

security-l 50

ip address

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Mon, 23 Jun 2008 00:25:17 GMT

For the host to set the interface address as their default-gateway would I need to use "dhcpd option 3 ip 192.168.100.1 interface GUESTS" assuming 192.168.100.1 is the ip address for interface g0/2? And for the host to route out my outside interface (to get to the internet) would I need to set a route?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Mon, 23 Jun 2008 01:23:27 GMT

I would assume that is required (setting the default gateway) for a properly designed network.

For the internet you just need a default route on the box:

route outside 0 0

Regards

Farrukh

Re: Guest network setup using ASA 5520

mbroberson1 — Mon, 23 Jun 2008 11:33:22 GMT

From what I have looked through the DNS and WINS for this type of setup are global so the guest network users would be using the same DNS and WINS server as the clients on the corporate network. Are you familiar with this?

Re: Guest network setup using ASA 5520

Farrukh Haroon — Mon, 23 Jun 2008 13:23:05 GMT

You can even skip DNS for the guest users. All they do is access the proxy server and the proxy server will resolve DNS for them.

Regards

Farrukh