Failed Firewall Issue

[teshagerasfaw]

Hello there, In my company network we were having Cisco ASA 5500 series firewall but, accidentally because of power surge we lost it. Any one who can just help me for security protection with other means will have a huge welcome. Temporarily I needed to allow internet connection to our clients as needed  so please help me with configuration issue on Cisco WS-C6513-E switch  so that I can connect ISP network directly to Core Switch. Thanks a lot.

[balaji.bandi · Accepted solution]

Switch does not do your work.

Example : you need NAT ( as your FW doing)

suggestion, if you have any Router you can build as NAT Router to get to internet ?

If not you need build one quick Linux based FW(if you have any old PC)

[marce1000]

               >....so that I can connect ISP network directly to Core Switch

  Very bad plan in terms of security. In the future consider HA firewalling solutions too.

 M.

[Joseph W. Doherty]

What sup and what IOS image in your 6513?

I don't recall whether a 6500 supports NAT/PAT, at least without something like the (old) FlexWAN cards.

If NAT is supported, and/or especially if PAT is supported, either will provide some security as "outside" needs to "match" against a current NAT or PAT entry to get back inside.

I also don't recall whether a 6500 support Reflexive ACLs, which provide "stateful" ACEs from inside to outside.

Something you can also do, with TCP traffic, is filter "outside" for return traffic with "established" in ACE (only works for TCP).