topic Cisco ASA5520 Basic configuration in Network Security

Cisco ASA5520 Basic configuration

haidar_alm — Mon, 11 Mar 2019 23:09:35 GMT

Hello,

This is my 1st time trying to configure an ASA.

I'm trying to establish a very basic connection (ping) between 2 laptops, one sat on the outside interface, and one on the inside as per the diagram below:

I can ping back and forth from the ASA to 192.168.1.4, and to 10.1.1.1. However, what I'm trying to achieve is to be able to ping from 10.1.1.1 to 192.168.1.4 and vice versa.

I have attached the configuration file with this post as well.

I suspect it's something simple and silly that I did. Can you please help?

Many thanks,

Cisco ASA5520 Basic configuration

varrao — Tue, 22 May 2012 10:17:06 GMT

Hi Haider,

you might just need to add this:

static (inside,outside) 192.168.1.4 192.168.1.4

make sure you also put a default route on the 192.168.1.4 machine with ASA inside as the gateway.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Cisco ASA5520 Basic configuration

haidar_alm — Tue, 22 May 2012 10:59:50 GMT

Many thanks for the reply.

It worked, however, I would like to know how!

🙂

I already had the (nat and global) command configured on it. Is that not enough?

Also, should the command not be

static (inside,outside) 10.1.1.2 192.168.1.4 255.255.255.255 ? <= i tried it and got an error.

I want the inside address of 192.168.1.4 to be mapped to the outside interface address of 10.1.1.2.

When I do show xlate, i can see that the 192 address is shown as itself globally.

I look forward to your reply.

Cisco ASA5520 Basic configuration

varrao — Tue, 22 May 2012 11:17:31 GMT

Hi Haider,

The nat global statements that you have, that is to pat the internal users, when they go out of the outside interface, it is not for connections coming in.

If you want to nat the internal IP with the outside interface of the ASA, you would need:

static (inside,outside) interface 192.168.1.4

But I would not advise that, because this statement would block the complete IP address for the internal server only. I would rather suggest port forwarding, which means, you are using only a single port on that IP. Here's the config:

static (inside,outside) interface 443 192.168.1.4 443

This shoudl be done.

Hope that helps.

Thanks,
Varun Rao
Security Team,
Cisco TAC

Cisco ASA5520 Basic configuration

varrao — Tue, 22 May 2012 11:18:49 GMT

Also make sure you open the ACL on outside:

access-list 100 permit tcp any interface outside eq 443

Thanks,
Varun Rao
Security Team,
Cisco TAC