topic Re: ASA5505 Setup Questions in Network Security

ASA5505 Setup Questions

vbdotnetman — Mon, 11 Mar 2019 14:41:16 GMT

I've come to the conclusion that Cisco should rename their â€œCisco ASA 5505 Getting Started Guideâ€ to â€œCisco ASA 550 A Guide To Spending A Lot Of Money And Receive Utter Frustration In Returnâ€. Nothing in this manual is consistent. On one page they use one set of IP addresses and on another they use something totally different. I'm not sure what IP addresses to place where anymoreâ€¦ I'm beginning to wonder about Cisco's ability to provide quality documentation. Anyway, I didn't mean to vent here but I am totally frustratedâ€¦..

On with the problem at handâ€¦â€¦

I have 3 pc's. Two are on the inside network and one in the dmz which acts as a Web/E-Mail server. I use an ISP which provides a public internet address of let's say 216.130.17.10 via DHCP. I also have a base license for the ASA 5505 so I realize the dmz cannot initiate any contact with the inside vlan but the inside vlan can talk to the dmz vlan. Oh, also I'm using the ASDM interface.

Question 1: Does the dmz have to have a separate public ip address provided by the ISP?

Question 2: How do you do port forwarding on this thing? I'd like to forward the web and mail server ports to the dmz.

Any help with this would be greatly appreciatedâ€¦..

Best Regards

Re: ASA5505 Setup Questions

jkgraham40 — Fri, 23 Jan 2009 16:02:59 GMT

The ASA is a very flexible device. As you know the license you have is limiting. I am sorry to tell you that for what you want you will need good knowledge of address translation(NAT) and access control lists (ACL). These are topics in the configuration manual. If you continue to use ASDM before understanding these chapters you will only get more frustrated.

Question 1: Does the dmz have to have a separate public ip address provided by the ISP?

Answer: The ASA can answer for multiple IP addresses through the use of address translation. You can use one public address or many.

Question 2: How do you do port forwarding on this thing? I'd like to forward the web and mail server ports to the dmz.

Answer: Very basic answer... You must first create a NAT then an ACL to identify the proper traffic.

Hope this helps get you started.

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 16:23:38 GMT

I was hoping to get some simple explinations here, not to be sent back to the very manuals that caused the frustration? I understand what net work translation and access list are. What I'm asking is this:

Given the configuration I've explained above,

Question 1: Does the dmz have to have a separate public ip address provided by the ISP? Or do I just make up an address?

Question 2: How does port forwarding work on the ASA-5505?

Best Regards

Re: ASA5505 Setup Questions

kwillacey — Fri, 23 Jan 2009 17:12:06 GMT

Josh answered your questions quite well actually and if you did understand translations and access list I think you would be fine at the moment.

Please follow the link below and it should help clear up some things for you.

http://www.cisco.com/en/US/docs/security/asa/asa80/getting_started/asa5500/quick/guide/dmz.html

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 17:55:06 GMT

Well, where do I start.

Thank you for your reference to the manual I've already read it and followed to the letter.

It still does not work...

Instead of telling me what I don't and sending me back to the manual I just used a simple answer to the two questions would surfice?

Best Regards

Re: ASA5505 Setup Questions

kwillacey — Fri, 23 Jan 2009 18:10:18 GMT

I don't think there is anything wrong with the documentation when I first started out that was what I used but anyway..... how far have you reached with configuring the device? Can you post your config?

You do not need to make up any IP addresses because otherwise what you are doing would not work. You do not need to assign any public addresses to your dmz hosts or dmz interface. The translations that are done will make the hosts appear as if it has a public IP when in fact it does not.

Also based on the fact that your outside address is assigned via dhcp any translations (assuming you have some dynamic dns setup so that mail can come in regardless of the public IP) you do will have to contain the interface keyword and not an IP address for it to work, I think.

All you need is the translations from outside to dmz and an access-list permitting that traffic inbound on the outside interface. So what will happen is anyone that attempts to send mail to your public IP on port 25, the ASA will forward that traffic to the host on the dmz.

Hope this helps.

***Also I don't think what you want is gonna work with the base license, but then again I have never worked with one with a base license. I always ensure that it comes with a security plus license.***

Re: ASA5505 Setup Questions

2go2marketing — Fri, 23 Jan 2009 18:29:36 GMT

Have you considered maybe using a managed firewall service like that of http://www.firewalloptions.com or http://www.viawest.net instead of doing it yourself? This may be a lot less stressful for you and you wouldn't have to read those manuals you dislike.

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 18:48:33 GMT

Hi kwillacey,

Thank you so much for your time and response.

Right now I have 1 PC connected to the dmz via port switch 0/7 and if I do a IPCONFIG /ALL on that PC it shows a bogus ip address of 169.254.58.220(this is not on my network or lan).

As I understand it the 169.254.58.220 address is a bogus address generated by windows when it does not have access to the network/router.

I know this is not a proper address to use to properly configure my dmz, so what address do I use?

Thankful for your response

Best Regards

Confused

Re: ASA5505 Setup Questions

Jon Marshall — Fri, 23 Jan 2009 18:58:38 GMT

Jose

Use any private address space you like. I don't know what addresses your internal LAN is using but as an example lets assign 192.168.5.0/24 to the DMZ.

On the ASA you will need to assign the DMZ interface an address from this range so lets say 192.168.5.1

then you need to give your PC in the DMZ an address from that range ie.

PC address - 192.168.5.2

PC subnet mask - 255.255.255.0

PC Default gateway - 192.168.5.1

then to give access to this PC from the outside

static (DMZ,outside) tcp interface 25 192.168.5.2 25 netmask 255.255.255.255

static (DMZ,outside) tcp interface 80 192.168.5.2 80 netmask 255.255.255.255

then you need an access-list to allow this traffic from outside.

Jon

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 19:57:34 GMT

Hi Jon,

I now have internet access to the dmz but I'm having a little trouble with the access list.

I'm using ASDM and create a rule that says:

Interface: outside

Source: any

Destination: 192.168.5.2

Service: tcp/smtp

It generates:

access-list outside_access_in extended permit tcp any host 192.168.5.2 eq smtp

But I cannot access my email server on the dmz?

Best Regards

Re: ASA5505 Setup Questions

Jon Marshall — Fri, 23 Jan 2009 20:00:20 GMT

You can't use the private address as the destination because it is presented as the outside interface IP address of your ASA to the Internet. Try

access-list outside_access_in permit tcp any host eq smtp

Jon

Re: ASA5505 Setup Questions

kwillacey — Fri, 23 Jan 2009 20:04:42 GMT

I wonder if you can get around that because his outside IP address might change from time to time because it's via DHCP, I mean besides having your ISP reserve that address for you or getting a static one form them.

Maybe something like

access-list outside_access_in permit tcp any host dhcp-assigned-outside eq smtp

LOL I'm just messing around but it would be cool if that was possible though.

***Glad to see you got the dmz up***

Re: ASA5505 Setup Questions

Jon Marshall — Fri, 23 Jan 2009 20:11:27 GMT

I think you can and i was just about to update my previous post

access-list outside_access_in permit tcp any interface outside eq smtp

Jon

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 20:17:08 GMT

jon,

I placed it into configuration as instructed , also did one for pop3, but still cannot retrieve my email from inside vlan pc?

Best Regards

Re: ASA5505 Setup Questions

kwillacey — Fri, 23 Jan 2009 20:22:29 GMT

You live and you learn, I never had a need to so I would have no clue.

Can you post your current config

Re: ASA5505 Setup Questions

Jon Marshall — Fri, 23 Jan 2009 20:27:06 GMT

Okay, i'm a bit confused here. If you want to access from outside then you need to use the public IP address in your access-list.

If you want to access from inside to DMZ then use the 192.168.5.2 address. You will also need a static statement eg. lets say your inside network is 192.168.1.0/24

static (inside,DMZ) 192.168.1.0 192.168.1.0 255.255.255.0

Jon

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 20:50:21 GMT

Jon,

the static statement you wrote has the same addresses in it?

Best Regards

Re: ASA5505 Setup Questions

Jon Marshall — Fri, 23 Jan 2009 21:00:44 GMT

Yes i know. This is how you tell the ASA that the inside addresses will appear as the same IP addresses on the DMZ.

Jon

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 21:18:51 GMT

Jon,

I placed the static statement in my configuration. Can't send an email from inside and receive an email from dmz. Not sure what going on. Have followed your instructions.

Re: ASA5505 Setup Questions

vbdotnetman — Fri, 23 Jan 2009 21:19:33 GMT

why would I want to do this?