topic Re: multinetting on asa in Network Security

multinetting on asa

cfajardo1_2 — Fri, 21 Feb 2020 09:49:28 GMT

does asa supports multinetting?

thnaks

Re: multinetting on asa

Collin Clark — Tue, 11 Dec 2007 18:13:40 GMT

What's multinetting?

Re: multinetting on asa

maratkinson — Tue, 11 Dec 2007 21:12:39 GMT

Multinetting?

Sounds like you might be talking about ...

- VLSM variable-length subnet masking

- Classless Inter-Domain Routing (CIDR)

- routing prefix aggregation (also known as "supernetting" or "route summarization")

http://en.wikipedia.org/wiki/VLSM

Re: multinetting on asa

acomiskey — Tue, 11 Dec 2007 21:15:43 GMT

He's probably talking about...

http://www.syngress.com/book_catalog/69_ipad/69_ipad_ce_01.htm#_Toc471028305

Re: multinetting on asa

Collin Clark — Tue, 11 Dec 2007 21:18:53 GMT

Geez Adam I hope you knew that off the top of your head 🙂

Celso, I have never tried it, but I'm pretty sure you can not assign multiple IP's to a single interface.

Re: multinetting on asa

acomiskey — Tue, 11 Dec 2007 21:25:25 GMT

Haha, google is my friend.

Re: multinetting on asa

JORGE RODRIGUEZ — Tue, 11 Dec 2007 21:31:24 GMT

This is correct, however, the only way I see this possible looking Adam's link is if you were to used 802.1q and subinterfaces in ASA 7.x each sub with same security level.

Rgds

Jorge

Re: multinetting on asa

maratkinson — Tue, 11 Dec 2007 21:42:07 GMT

Ahh ... yes, use multiple VLAN's to segment up a single interface. We have several ASA 5520's running that configuration.

Sample of such: Notice that you can assign different Security levels.

interface GigabitEthernet0/2

speed 1000

duplex full

nameif SUB-DMZ

security-level 60

no ip address

interface GigabitEthernet0/2.2114

description Citrix

vlan 2114

nameif SUB_Citrix

security-level 75

ip address 172.17.122.x 255.255.255.x

interface GigabitEthernet0/2.2126

description Secure Email Sub DMZ

vlan 2126

nameif SUB_SEC_EMAIL

security-level 75

ip address 172.17.123.x 255.255.255.x

Re: multinetting on asa

Collin Clark — Tue, 11 Dec 2007 21:46:23 GMT

OK, but what about routing? How can you control which interface the traffic leaves on? Assuming you care about that.

Re: multinetting on asa

JORGE RODRIGUEZ — Tue, 11 Dec 2007 22:13:29 GMT

Marc, using your config and Adam's example link the scenario of multiple IPs per interface could be accomplished this way.

interface GigabitEthernet0/2

speed 1000

duplex full

nameif NET

security-level 75

no ip address

interface GigabitEthernet0/2.183

description Network 183.55.2.0

vlan 183

nameif NET183

security-level 75

ip address 183.55.2.77 255.255.255.0

interface GigabitEthernet0/2.204

description Network 204.238.7.0

vlan 204

nameif NET204

security-level 75

ip address 204.238.7.22 255.255.255.0

interface GigabitEthernet0/2.88

description Network 88.127.6.0

vlan 88

nameif NET88

security-level 75

ip address 88.127.6.209 255.255.255.0

use same-security-traffic permit inter-interface command to pass traffic between these nets without the use of ACLs.

Re: multinetting on asa

JORGE RODRIGUEZ — Tue, 11 Dec 2007 22:22:11 GMT

What do you mean by routing? you can route between same security interfaces without issues, subinterfaces are routed interfaces are they not.. perhaps I don't understand you when you said " what about routing" ?

Rgds

Jorge

Re: multinetting on asa

cfajardo1_2 — Tue, 18 Dec 2007 14:44:52 GMT

sorry for late reply..the CSS11500 supports firewall load balancing FWLB and in one of the mode, it seems like the firewall should support multinetting.(multiple ip address)

Re: multinetting on asa

cfajardo1_2 — Tue, 18 Dec 2007 14:56:17 GMT

check this link on page 107

http://www.cisco.com/en/US/docs/app_ntwk_services/data_center_app_services/c

ss11500series/v7.40/configuration/security/guide/Security.pdf