topic Re: Permit traffic to inside via MAC - address? in Network Security

Permit traffic to inside via MAC - address?

Scott Payne — Mon, 11 Mar 2019 20:18:20 GMT

Hello everyone!

I have a handheld device that will be used for inventory outside of our office. It has 3g capabilities. Is there anyway I can permit traffic from this device from the outside world coming into my network? I need to open a couple of ports so it can hit the server. But I have no intention to open these ports up to the entire world. I use an ASA 5520 with a managed router from our provider. I looked around on the Cisco site and the only information I found was for permitting and denying traffic from devices that are within the network.

Re: Permit traffic to inside via MAC - address?

Shrikant Sundaresh — Thu, 07 Apr 2011 20:04:23 GMT

Hi Scott,

It is not possible to do what you are trying to acheive, not because the ASA doesn't support it, but because the way a packet travels in a network.

Lets suppose you have the following topology:

A------------B(router1)C---------D(router2)E---------F

A is you mobile and F your server.

When A wants to communicate with F, the packet header goes as: IP(A),IP(F),MAC(A),MAC(B)

Then beyond router1: IP(A),IP(F),MAC(C),MAC(D)

MAC(A) is already lost, and cannot be used to regulate traffic on the next router.

Thus the ASA would see most of internet traffic with the source MAC of its next hop gateway.

So one option for you, if the hand held device can do remote access VPN: is to configure the ASA for remote access vpn, and then connect to the ASA in that fashion. So only those who know the username password etc, will be able to have access.

But then, if I am not mistaken, you would need to purchase certain licenses for the ASA to support that.

Alternately, you would have to open the ports to the internet, which as you have mentioned, would let it become accessible by anyone.

However, if you could configure a login mechanism for those services on the server, and per client tcp connection limits (of say 5) on the ASA, then you should be well guarded in my opinion.

Hope this helps.

-Shrikant

P.S.: Please mark the question resolved, if it has been answered. Do rate helpful posts. Thanks.

Re: Permit traffic to inside via MAC - address?

Scott Payne — Thu, 07 Apr 2011 20:08:18 GMT

I was about 99.999% that was the case. But sometimes the gurus out there come up with a way i haven't thought of. I apprecaite your quick response!