topic Re: ASA 5510 configuration problem in Network Security

ASA 5510 configuration problem

junshah22 — Mon, 11 Mar 2019 15:26:27 GMT

Dear All,

I am configuring my ASA 5510 but having some problems,

I am placing ASA very next to Router,

1- Router (Directly attached with Internet via live IP)

2-ASA (Connected with Router)

3-ASA DMZ interface (Servers are connected with it)

4-ASA other fa interface connected with Core switch (3560)

Vlans are configured on 3560 and inter vlan routing is in place via ACLs

OSPF is running on ASA, Core switch and Router,

PROBLEM

Users in Core switch Vlans can communicate with ASA but cannot communicate with DMZ

Cannot communicate with Internet Router

Router, Switch and ASA are showing Routes in their Routing Tables, but are unable to ping...

Please advise, whether is there any other configuration required on ASA,

ASA can communicate with Core switch Vlan Users, DMZ and Internet,

BUT

DMZ is unable to communicate with Core

DMZ is unable to communicate with Internet

PLEASE HELP,

REGARDS,

JUNAID

Re: ASA 5510 configuration problem

andrew.prince — Sat, 02 May 2009 06:55:02 GMT

Check your NAT - have you configured it correctly.

Check your interface security levels - have you configured them correctly

Check you access-lists to allow traffic from lower security levels to higher security levels.

The ASA is a FIREWALL NOT a router.

Below is some config guides to assist you in troubleshooting your config:-

http://www.cisco.com/en/US/products/ps6120/tsd_products_support_configure.html

HTH>

Re: ASA 5510 configuration problem

mdombek_biz — Sat, 02 May 2009 07:43:28 GMT

Additional to Andrew I would have a look at your security levels for the DMZ interface. If you have set it to 0 you will not be able to communicate with internet and Inside .. since the ASA denies traffic from lower (or equal) level interfaces. So you can't by default communicate from 0 to 100 or 0 to 0 ....

but first i would really check the NAT

cheers Michael

Re: ASA 5510 configuration problem

junshah22 — Sat, 02 May 2009 09:17:44 GMT

Dear Michael,

I set my security level for all interfaces is 50

security level 50 for DMZ

50 for Inside

50 for Outside

secondly,, I haven't applied NAT... NATING is performed by Router

Re: ASA 5510 configuration problem

andrew.prince — Sat, 02 May 2009 09:29:04 GMT

read the below:-

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/int5505.html#wp1043290

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/int5505.html#wp1039276

http://www.cisco.com/en/US/docs/security/asa/asa80/configuration/guide/cfgnat.html#wpxref77088

HTH>

Re: ASA 5510 configuration problem

junshah22 — Sat, 02 May 2009 10:01:01 GMT

What security level do you suggest for DMZ, Inside and Outside,

Re: ASA 5510 configuration problem

andrew.prince — Sat, 02 May 2009 10:36:24 GMT

Outside - 0

DMZ - 50

Inside - 100

You then control what can access the inside, from the outside/dmz. You can also control what can access the dmz from the outside. The inside can access everything as default.