Hi,
Is there any specific reason this Vlan55 is separate from all the other Vlans?
So I guess next we could do the following steps (Presuming the ASA is still configured like in your previous posted configuration)
Remove the Subinterface
no interface Ethernet0/2.1
Aquire an IP address for the ASA
Unless you manage the Vlan55 address space you will have to ask someone to give an IP address from the Vlan55 network that you can configure on the ASA "outside" interface. When you get that IP address use it with the below configuration.
interface Ethernet0/2
description Link to 2960
nameif outside
security-level 0
ip address 10.63.210.xxx 255.255.255.128
Define a default route
We will route all traffic to networks that are not local to the default gateway of Vlan55. Which I presume holds the Internet connectivity
route outside 0.0.0.0 0.0.0.0 10.63.210.129
Define NAT0 / NAT Exempt for the LAN networks behind ASA
As the Internet connection isnt directly connected to the ASA "outside" interface there is no need to NAT the LAN networks. So we will configure the below NAT0
access-list INSIDE-NAT0 remark NO NAT for LAN networks Behind ASA
access-list INSIDE-NAT0 permit ip 192.168.162.0 255.255.255.0 any
access-list INSIDE-NAT0 permit ip 192.168.3.0 255.255.255.0 any
access-list INSIDE-NAT0 permit ip 172.17.1.0 255.255.255.0 any
nat (inside) 0 access-list INSIDE-NAT0
Add ICMP Inspection on the ASA
This will help allowing ICMP traffic through the ASA if you are testing something with ICMP. Naturally we have to consider that there is other device controlling Internet traffic so it might prevent something.
policy-map global_policy
class inspection_default
inspect icmp
inspect icmp error
Request that route for the 3 LAN networks are routed from the Internet router/device towards the ASA outside IP address
We need the Internet Router/device to know where your LAN networks recide since we are not doing any NAT for the 3 LAN networks
Request that the Internet Router/device is configured with NAT rules which will allow the 3 LAN networks behind the ASA to be NATed towards Internet
We need the Internet Router/device also to have NAT rules on it for your 3 LAN networks so they will get NATed to a public IP address to enable Internet connectivity.
Also one optional thing you can try which DOESNT require any configurations on the Internet Router to my understanding.
First you will need some IP address from the Vlan55 that you know is free and not used by any device. You then configure the "outside" interface just like in the above example. You also configure the default route just like above.
But instead of NAT0 you configure PAT for the 3 LAN networks
global (outside) 1 interface
nat (inside) 1 192.168.162.0 255.255.255.0
nat (inside) 1 192.168.3.0 255.255.255.0
nat (inside) 1 172.17.1.0 255.255.255.0
What this will do is PAT all the traffic from the 3 LANs to the "outside" ip address of the ASA. As that IP address is part of the Vlan55 network it probably means that it has all the necesary configurations on the Internet Router/device and you potentially will be able to access Internet.
Even either of the above options work this is not an ideal setup. It would be best if the actual public IP address (or range/subnet) was configured directly on the ASA rather than some other device. And also that the Vlan55 was behind the ASA. Perhaps as its own interface if it needs to be kept separate by the other 3 LAN networks by the firewall.
But to my understanding the main priority is to get Internet connectivity.
Whew, finally done with the writing.
- Jouni
